Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Test a HEAD aimed outside its repository
The defbranch check had a test while its twin for a crafted HEAD,
which the index reads the same way to date a repository, had none.
Diffstat (limited to 'tests')
| -rwxr-xr-x | tests/t0303-robustness.sh | 18 |
1 file changed, 18 insertions, 0 deletions
diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh index 7e79b87..d511ac1 100755 --- a/tests/t0303-robustness.sh +++ b/tests/t0303-robustness.sh @@ -870,4 +870,22 @@ test_expect_success 'a scanned defbranch cannot name a path outside the reposito ! grep "data-ut=.946" tmp ' +# HEAD is a file the repository's owner writes as well, and the index stats +# the branch it names to date the repository. +test_expect_success 'a crafted HEAD cannot date a repository from outside it' ' + mkdir -p aimed && + touch -t 200001010000 aimed/file && + git init -q --bare headscan/h.git && + echo "ref: refs/heads/../../../../aimed/file" >headscan/h.git/HEAD && + { + echo "virtual-root=/" && + echo "cache-size=0" && + echo "scan-path=$PWD/headscan" + } >headrc && + cgit_rc headrc "url=" >tmp && + test_grep "^Status: 200" tmp && + test_grep ">h.git</a>" tmp && + test_grep ! "data-ut=.946" tmp +' + test_done |