Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Percent-encode file paths in side-by-side diffs
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/t0200-security.sh | 26 |
1 file changed, 26 insertions, 0 deletions
diff --git a/tests/t0200-security.sh b/tests/t0200-security.sh index 44703c9..4eee9ae 100644 --- a/tests/t0200-security.sh +++ b/tests/t0200-security.sh @@ -149,4 +149,30 @@ test_expect_success 'enable-help=0 hides the tab and the page' ' grep "Status: 404" tmp ' +# --- Side-by-side diff percent-encodes a file path into its links ----------- +# A file name is repository content and may contain a quote, which would +# otherwise break out of the href attribute of the line-number links. +test_expect_success 'ssdiff percent-encodes a quoted file path' ' + mkrepo repos/xss 1 && + name=$(printf "x\047y.txt") && + ( + cd repos/xss && + printf "a\nb\n" >"$name" && + git add -A && + git commit -m add && + printf "a\nc\n" >"$name" && + git commit -am change + ) && + { + echo "virtual-root=/" && + echo "cache-size=0" && + echo "repo.url=xss" && + echo "repo.path=$PWD/repos/xss/.git" + } >xssrc && + sha=$(git -C repos/xss rev-parse HEAD) && + CGIT_CONFIG="$PWD/xssrc" QUERY_STRING="url=xss/diff/&id=$sha&ss=1" cgit >tmp && + grep "tree/x%27y.txt" tmp && + ! grep "href=.[^>]*x.y.txt.[^>]*>" tmp +' + test_done |