Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Test the leading slashes stripped from a url
Nothing showed that every leading slash goes, through url= or
PATH_INFO, and one left behind joins the virtual root into a
scheme-relative link to another host.
Diffstat (limited to 'tests')
| -rwxr-xr-x | tests/t0301-security.sh | 16 |
1 file changed, 16 insertions, 0 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 47d1a0a..092e0a9 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -457,6 +457,22 @@ test_expect_success 'the advisory payloads fail the same way through PATH_INFO' test_path_is_missing repos/cve/pwned ' +# Every leading slash goes, or a url opening with two would come out of the +# virtual root as a scheme-relative link to another host. +test_expect_success 'a url opening with slashes links only below the site' ' + cgitrc_copy slashrc && + cgit_rc slashrc "url=//evil.example/" >tmp && + test_grep "action=./evil.example/.>" tmp && + test_grep ! -e "href=.//" -e "action=.//" tmp && + cgit_path slashrc //evil.example/ >tmp && + test_grep "action=./evil.example/.>" tmp && + test_grep ! -e "href=.//" -e "action=.//" tmp && + cgit_ok slashrc "url=//f" >tmp && + test_grep "action=./f.>" tmp && + cgit_ok_path slashrc //f >tmp && + test_grep "action=./f.>" tmp +' + # An untrusted response hands over repository bytes as they are. An image # keeps its own type, SVG among them, so script inside one is held back by # the policy alone. The cache listing prints keys visitors chose. |