Prove the login body is cut at the buffer

The posted body was 22 bytes, so an unclamped read stopped at its end
and nothing overflowed, and the test could not fail. The filter now
counts what it was handed from a body larger than the buffer.

1 file changed, 16 insertions, 5 deletions

diff --git a/tests/t0301-security.sh b/tests/t0301-security.shindex b62fc62..835e922 100755--- a/tests/t0301-security.sh+++ b/tests/t0301-security.sh@@ -318,7 +318,7 @@ test_expect_success 'set up the advisory fixtures' ' 	write_script auth.sh <<-\EOF && 	case "$1" in 	authenticate-post)-		cat >/dev/null+		wc -c >received 		printf "Status: 302 Found\nLocation: /\n\n" 		;; 	esac@@ -334,11 +334,22 @@ test_expect_success 'a newline in a file name cannot split the headers' ' 	grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.txt.$" tmp ' +# The body has to outgrow the 4096 byte buffer, or an unclamped read would+# still stop at the end of the body and nothing would overflow. A length of+# -1 reaches cgit as the largest number strtoul can return. test_expect_success 'a posted length past any buffer is clamped' '-	echo "username=a&password=b" |-	CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=99999999999999 \-		QUERY_STRING="p=login" cgit >tmp &&-	grep "^Status: 302" tmp+	test_seq 2000 >body &&+	for length in 99999999999999 -1+	do+		rm -f received &&+		CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=$length \+			QUERY_STRING="p=login" cgit <body >tmp &&+		test_grep "^Status: 302" tmp &&+		test $(cat received) = 4096 || return 1+	done &&+	CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=10 \+		QUERY_STRING="p=login" cgit <body >tmp &&+	test $(cat received) = 10 '  test_expect_success 'the dumb transport refuses a path that climbs out' '
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index b62fc62..835e922 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -318,7 +318,7 @@ test_expect_success 'set up the advisory fixtures' '
 	write_script auth.sh <<-\EOF &&
 	case "$1" in
 	authenticate-post)
-		cat >/dev/null
+		wc -c >received
 		printf "Status: 302 Found\nLocation: /\n\n"
 		;;
 	esac
@@ -334,11 +334,22 @@ test_expect_success 'a newline in a file name cannot split the headers' '
 	grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.txt.$" tmp
 '
 
+# The body has to outgrow the 4096 byte buffer, or an unclamped read would
+# still stop at the end of the body and nothing would overflow. A length of
+# -1 reaches cgit as the largest number strtoul can return.
 test_expect_success 'a posted length past any buffer is clamped' '
-	echo "username=a&password=b" |
-	CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=99999999999999 \
-		QUERY_STRING="p=login" cgit >tmp &&
-	grep "^Status: 302" tmp
+	test_seq 2000 >body &&
+	for length in 99999999999999 -1
+	do
+		rm -f received &&
+		CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=$length \
+			QUERY_STRING="p=login" cgit <body >tmp &&
+		test_grep "^Status: 302" tmp &&
+		test $(cat received) = 4096 || return 1
+	done &&
+	CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=10 \
+		QUERY_STRING="p=login" cgit <body >tmp &&
+	test $(cat received) = 10
 '
 
 test_expect_success 'the dumb transport refuses a path that climbs out' '