Resolve submodule links from .gitmodules

2 files changed, 149 insertions, 1 deletion

diff --git a/tests/t0112-submodule-links.sh b/tests/t0112-submodule-links.shnew file mode 100755index 0000000..bbd99b4--- /dev/null+++ b/tests/t0112-submodule-links.sh@@ -0,0 +1,109 @@+#!/bin/sh++# Submodule rows can derive their links from the .gitmodules entry at the+# shown revision once enable-gitmodules-links is set. The url is matched+# against the repositories this instance serves first, so ssh and relative+# urls still land on an internal page, a plain web url is linked directly,+# an ssh url to a known host is rewritten to its web form, and anything+# else stays unlinked with the url offered as a tooltip.++test_description='Check submodule links derived from .gitmodules'+. ./setup.sh++test_expect_success 'set up a parent repo with submodules' '+	mkrepo repos/subtarget 1 &&+	mkrepo repos/subparent 1 &&+	(+		cd repos/subparent &&+		sub=$(git rev-parse HEAD) &&+		git update-index --add --cacheinfo 160000,$sub,local-ssh &&+		git update-index --add --cacheinfo 160000,$sub,sibling &&+		git update-index --add --cacheinfo 160000,$sub,forge-https &&+		git update-index --add --cacheinfo 160000,$sub,forge-ssh &&+		git update-index --add --cacheinfo 160000,$sub,opaque &&+		git update-index --add --cacheinfo 160000,$sub,cgit-host &&+		cat >.gitmodules <<-\EOF &&+		[submodule "local-ssh"]+			path = local-ssh+			url = git@example.com:mirrors/subtarget.git+		[submodule "sibling"]+			path = sibling+			url = ../subtarget.git+		[submodule "forge-https"]+			path = forge-https+			url = https://github.com/example/project.git+		[submodule "forge-ssh"]+			path = forge-ssh+			url = git@github.com:example/other.git+		[submodule "opaque"]+			path = opaque+			url = git@private.example.com:closed/thing.git+		[submodule "cgit-host"]+			path = cgit-host+			url = https://git.kernel.org/pub/scm/git/git.git+		EOF+		git add .gitmodules &&+		git commit -m submodules+	) &&+	{+		echo "virtual-root=/" &&+		echo "cache-size=0" &&+		echo "enable-gitmodules-links=1" &&+		echo "repo.url=subparent" &&+		echo "repo.path=$PWD/repos/subparent/.git" &&+		echo "repo.url=subtarget" &&+		echo "repo.path=$PWD/repos/subtarget/.git"+	} >subrc+'++test_expect_success 'generate subparent/tree' '+	CGIT_CONFIG="$PWD/subrc" QUERY_STRING="url=subparent/tree/" cgit >tmp+'++test_expect_success 'an ssh url served here links to the local repo' '+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&+	grep "href=./subtarget/tree/?id=$sub.>local-ssh</a>" tmp+'++test_expect_success 'its hash links to the local commit page' '+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&+	grep "href=./subtarget/commit/?id=$sub." tmp+'++test_expect_success 'a relative url resolves against this repository' '+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&+	grep "href=./subtarget/tree/?id=$sub.>sibling</a>" tmp+'++test_expect_success 'a web url is linked as it is' '+	grep "href=.https://github.com/example/project.git.>forge-https</a>" tmp+'++test_expect_success 'a known forge hash links to its commit page' '+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&+	grep "href=.https://github.com/example/project/commit/$sub." tmp+'++test_expect_success 'an ssh url to a known forge is rewritten' '+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&+	grep "href=.https://github.com/example/other.>forge-ssh</a>" tmp &&+	grep "href=.https://github.com/example/other/commit/$sub." tmp+'++test_expect_success 'a cgit host keeps its .git suffix in the commit link' '+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&+	grep "href=.https://git.kernel.org/pub/scm/git/git.git/commit/?id=$sub." tmp+'++test_expect_success 'an unresolvable url stays unlinked with a tooltip' '+	grep "class=.ls-mod. title=.git@private.example.com:closed/thing.git.>opaque</span>" tmp+'++test_expect_success 'the links stay off without the flag' '+	sed "/enable-gitmodules-links/d" subrc >subrcoff &&+	CGIT_CONFIG="$PWD/subrcoff" QUERY_STRING="url=subparent/tree/" cgit >tmp &&+	! grep "subtarget/tree" tmp &&+	grep "class=.ls-mod.>local-ssh</span>" tmp+'++test_done
diff --git a/tests/t0112-submodule-links.sh b/tests/t0112-submodule-links.sh
new file mode 100755
index 0000000..bbd99b4
--- /dev/null
+++ b/tests/t0112-submodule-links.sh
@@ -0,0 +1,109 @@
+#!/bin/sh
+
+# Submodule rows can derive their links from the .gitmodules entry at the
+# shown revision once enable-gitmodules-links is set. The url is matched
+# against the repositories this instance serves first, so ssh and relative
+# urls still land on an internal page, a plain web url is linked directly,
+# an ssh url to a known host is rewritten to its web form, and anything
+# else stays unlinked with the url offered as a tooltip.
+
+test_description='Check submodule links derived from .gitmodules'
+. ./setup.sh
+
+test_expect_success 'set up a parent repo with submodules' '
+	mkrepo repos/subtarget 1 &&
+	mkrepo repos/subparent 1 &&
+	(
+		cd repos/subparent &&
+		sub=$(git rev-parse HEAD) &&
+		git update-index --add --cacheinfo 160000,$sub,local-ssh &&
+		git update-index --add --cacheinfo 160000,$sub,sibling &&
+		git update-index --add --cacheinfo 160000,$sub,forge-https &&
+		git update-index --add --cacheinfo 160000,$sub,forge-ssh &&
+		git update-index --add --cacheinfo 160000,$sub,opaque &&
+		git update-index --add --cacheinfo 160000,$sub,cgit-host &&
+		cat >.gitmodules <<-\EOF &&
+		[submodule "local-ssh"]
+			path = local-ssh
+			url = git@example.com:mirrors/subtarget.git
+		[submodule "sibling"]
+			path = sibling
+			url = ../subtarget.git
+		[submodule "forge-https"]
+			path = forge-https
+			url = https://github.com/example/project.git
+		[submodule "forge-ssh"]
+			path = forge-ssh
+			url = git@github.com:example/other.git
+		[submodule "opaque"]
+			path = opaque
+			url = git@private.example.com:closed/thing.git
+		[submodule "cgit-host"]
+			path = cgit-host
+			url = https://git.kernel.org/pub/scm/git/git.git
+		EOF
+		git add .gitmodules &&
+		git commit -m submodules
+	) &&
+	{
+		echo "virtual-root=/" &&
+		echo "cache-size=0" &&
+		echo "enable-gitmodules-links=1" &&
+		echo "repo.url=subparent" &&
+		echo "repo.path=$PWD/repos/subparent/.git" &&
+		echo "repo.url=subtarget" &&
+		echo "repo.path=$PWD/repos/subtarget/.git"
+	} >subrc
+'
+
+test_expect_success 'generate subparent/tree' '
+	CGIT_CONFIG="$PWD/subrc" QUERY_STRING="url=subparent/tree/" cgit >tmp
+'
+
+test_expect_success 'an ssh url served here links to the local repo' '
+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&
+	grep "href=./subtarget/tree/?id=$sub.>local-ssh</a>" tmp
+'
+
+test_expect_success 'its hash links to the local commit page' '
+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&
+	grep "href=./subtarget/commit/?id=$sub." tmp
+'
+
+test_expect_success 'a relative url resolves against this repository' '
+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&
+	grep "href=./subtarget/tree/?id=$sub.>sibling</a>" tmp
+'
+
+test_expect_success 'a web url is linked as it is' '
+	grep "href=.https://github.com/example/project.git.>forge-https</a>" tmp
+'
+
+test_expect_success 'a known forge hash links to its commit page' '
+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&
+	grep "href=.https://github.com/example/project/commit/$sub." tmp
+'
+
+test_expect_success 'an ssh url to a known forge is rewritten' '
+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&
+	grep "href=.https://github.com/example/other.>forge-ssh</a>" tmp &&
+	grep "href=.https://github.com/example/other/commit/$sub." tmp
+'
+
+test_expect_success 'a cgit host keeps its .git suffix in the commit link' '
+	sub=$(git -C repos/subparent rev-parse HEAD~1) &&
+	grep "href=.https://git.kernel.org/pub/scm/git/git.git/commit/?id=$sub." tmp
+'
+
+test_expect_success 'an unresolvable url stays unlinked with a tooltip' '
+	grep "class=.ls-mod. title=.git@private.example.com:closed/thing.git.>opaque</span>" tmp
+'
+
+test_expect_success 'the links stay off without the flag' '
+	sed "/enable-gitmodules-links/d" subrc >subrcoff &&
+	CGIT_CONFIG="$PWD/subrcoff" QUERY_STRING="url=subparent/tree/" cgit >tmp &&
+	! grep "subtarget/tree" tmp &&
+	grep "class=.ls-mod.>local-ssh</span>" tmp
+'
+
+test_done
diff --git a/tests/t0200-security.sh b/tests/t0200-security.shindex f475301..8fce5f4 100755--- a/tests/t0200-security.sh+++ b/tests/t0200-security.sh@@ -277,7 +277,7 @@ test_expect_success 'a surplus conversion is shown literally, not filled' ' 	grep "href=./m/submod/[0-9a-f]*/%s/%s/" tmp ' -test_expect_success 'a well-formed module-link still takes path and sha1' '+test_expect_success 'a well-formed module-link still takes name and sha1' ' 	{ 		echo "virtual-root=/" && 		echo "cache-size=0" &&@@ -316,4 +316,43 @@ test_expect_success 'a doubled percent in a module-link renders as one' ' 	grep "href=./m/submod/%/$sub." tmp ' +# The .gitmodules file is commit-controlled content, so a derived link may+# carry any scheme and any byte an author can commit. Only http and https+# may reach an href, and everything lands attribute-escaped.+test_expect_success 'set up a hostile .gitmodules' '+	(+		cd repos/modlink &&+		sub=$(git rev-parse HEAD) &&+		git update-index --add --cacheinfo 160000,$sub,quoted &&+		cat >.gitmodules <<-EOF &&+		[submodule "submod"]+			path = submod+			url = javascript:alert(1)+		[submodule "quoted"]+			path = quoted+			url = https://example.com/x'\''><script>alert(1)</script>+		EOF+		git add .gitmodules &&+		git commit -m hostile+	) &&+	{+		echo "virtual-root=/" &&+		echo "cache-size=0" &&+		echo "enable-gitmodules-links=1" &&+		echo "repo.url=modlink" &&+		echo "repo.path=$PWD/repos/modlink/.git"+	} >modlinkgmrc+'++test_expect_success 'a javascript url never reaches an href' '+	CGIT_CONFIG="$PWD/modlinkgmrc" QUERY_STRING="url=modlink/tree/" cgit >tmp &&+	! grep "href=.javascript:" tmp &&+	grep "class=.ls-mod. title=.javascript:alert(1).>submod</span>" tmp+'++test_expect_success 'a quote in a web url cannot break out of the href' '+	! grep "<script>alert" tmp &&+	grep "href=.https://example.com/x&#x27;&gt;&lt;script&gt;" tmp+'+ test_done
diff --git a/tests/t0200-security.sh b/tests/t0200-security.sh
index f475301..8fce5f4 100755
--- a/tests/t0200-security.sh
+++ b/tests/t0200-security.sh
@@ -277,7 +277,7 @@ test_expect_success 'a surplus conversion is shown literally, not filled' '
 	grep "href=./m/submod/[0-9a-f]*/%s/%s/" tmp
 '
 
-test_expect_success 'a well-formed module-link still takes path and sha1' '
+test_expect_success 'a well-formed module-link still takes name and sha1' '
 	{
 		echo "virtual-root=/" &&
 		echo "cache-size=0" &&
@@ -316,4 +316,43 @@ test_expect_success 'a doubled percent in a module-link renders as one' '
 	grep "href=./m/submod/%/$sub." tmp
 '
 
+# The .gitmodules file is commit-controlled content, so a derived link may
+# carry any scheme and any byte an author can commit. Only http and https
+# may reach an href, and everything lands attribute-escaped.
+test_expect_success 'set up a hostile .gitmodules' '
+	(
+		cd repos/modlink &&
+		sub=$(git rev-parse HEAD) &&
+		git update-index --add --cacheinfo 160000,$sub,quoted &&
+		cat >.gitmodules <<-EOF &&
+		[submodule "submod"]
+			path = submod
+			url = javascript:alert(1)
+		[submodule "quoted"]
+			path = quoted
+			url = https://example.com/x'\''><script>alert(1)</script>
+		EOF
+		git add .gitmodules &&
+		git commit -m hostile
+	) &&
+	{
+		echo "virtual-root=/" &&
+		echo "cache-size=0" &&
+		echo "enable-gitmodules-links=1" &&
+		echo "repo.url=modlink" &&
+		echo "repo.path=$PWD/repos/modlink/.git"
+	} >modlinkgmrc
+'
+
+test_expect_success 'a javascript url never reaches an href' '
+	CGIT_CONFIG="$PWD/modlinkgmrc" QUERY_STRING="url=modlink/tree/" cgit >tmp &&
+	! grep "href=.javascript:" tmp &&
+	grep "class=.ls-mod. title=.javascript:alert(1).>submod</span>" tmp
+'
+
+test_expect_success 'a quote in a web url cannot break out of the href' '
+	! grep "<script>alert" tmp &&
+	grep "href=.https://example.com/x&#x27;&gt;&lt;script&gt;" tmp
+'
+
 test_done