Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Test request values a page echoes back
Only %zz%2 had been sent, so nothing showed that markup in the query,
the hidden inputs a form carries, the errors naming a refused value or
the Host header is escaped on its way back.
Diffstat (limited to 'tests')
| -rwxr-xr-x | tests/t0301-security.sh | 36 |
1 file changed, 36 insertions, 0 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index c9f16a5..40de049 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -554,4 +554,40 @@ test_expect_success 'names and messages holding markup are escaped on every page test_grep ! "<x>" tmp ' +# A page echoes the request in the search box, in the hidden inputs that +# carry a form's state, in the error naming what it refused and, from the +# Host header, in every absolute link. +test_expect_success 'request values echoed into a page are escaped' ' + payload=%27%3E%3Cs%3E && + escaped="'><s>" && + cgit_ok mkrc "url=mk/log/&q=$payload&qt=$payload&id=$payload" >tmp && + test_grep "name=.q. aria-label=.Search. value=.$escaped.>" tmp && + for name in q qt id + do + test_grep "<input type=.hidden. name=.$name. value=.$escaped.>" tmp || return 1 + done && + test_grep ! "<s>" tmp && + cgit_ok mkrc "url=mk/log/&h=br%27%22%3Cx%3E%26" >tmp && + test_grep "<input type=.hidden. name=.h. value=.br'"<x>&.>" tmp && + test_grep ! "<x>" tmp && + cgit_rc mkrc "url=mk/log/&h=%3Cb%3E" >tmp && + test_grep "<div class=.error.>Invalid branch: <b></div>" tmp && + cgit_rc mkrc "url=mk/snapshot/%3Cb%3E.zzz" >tmp && + test_grep "<div class=.error.>Unsupported snapshot format: <b>.zzz</div>" tmp && + cgit_rc mkrc "url=mk/blob/%3Cb%3E" >tmp && + test_grep "<div class=.error.>Path not found: <b></div>" tmp && + test_grep ! "<b>" tmp && + ( + HTTP_HOST="h'\''\"<x>" && + export HTTP_HOST && + cgit_ok mkrc "url=mk/" >tmp && + test_grep "<link rel=.alternate. title=.Atom feed. href=.http://h'"<x>/mk/atom/?h=master." tmp && + test_grep ! "<x>" tmp && + cgit_ok mkrc "url=mk/atom/" >tmp && + test_grep "<id>http://h..<x>/mk/atom/</id>" tmp && + test_grep "<link rel=.alternate. type=.text/html. href=.http://h'"<x>/mk/./>" tmp && + test_grep ! "<x>" tmp + ) +' + test_done |