Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Read the --output refusal from its own request
The refusal was read from a page the previous test had left, which
--run could skip, and both requests went through the shared page
cache. The marker is also named apart from the one the filter test
plants, so a failure in one cannot fail the other.
Diffstat (limited to 'tests')
| -rwxr-xr-x | tests/t0301-security.sh | 20 |
1 file changed, 10 insertions, 10 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index ff1c241..4d33832 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -28,20 +28,20 @@ test_expect_success 'set up security fixtures' ' # A revision beginning with a dash reaches git as an option rather than as a # tip, so a request for id=--output=<path> could create or truncate any file -# the server is able to write. -test_expect_success 'log id=--output does not write a file' ' - cgit_url "foo/log&id=--output=$PWD/pwned" >tmp 2>&1 && - ! test -e pwned -' - -test_expect_success 'log id=--output is rejected as an invalid revision' ' - grep -i "invalid revision" tmp +# the server is able to write. The request check and the log page refuse it +# with the same words, so the page cannot tell which of them did. +test_expect_success 'log id=--output is refused without writing a file' ' + cgitrc_copy nocacherc && + cgit_rc nocacherc "url=foo/log&id=--output=$PWD/log-output" >tmp && + test_grep "^Status: 400" tmp && + test_grep "<div class=.error.>Invalid revision</div>" tmp && + test_path_is_missing log-output ' test_expect_success 'a valid id= still renders the log' ' sha=$(git -C repos/foo rev-parse HEAD) && - cgit_url "foo/log&id=$sha" >tmp && - grep -i "commit 5" tmp + cgit_ok_url "foo/log&id=$sha" >tmp && + test_grep ">commit 5</a>" tmp ' test_expect_success 'a small blob is still served' ' |