Percent-encode file paths in side-by-side diffs

1 file changed, 26 insertions, 0 deletions

diff --git a/tests/t0200-security.sh b/tests/t0200-security.sh
index 44703c9..4eee9ae 100644
--- a/tests/t0200-security.sh
+++ b/tests/t0200-security.sh
@@ -149,4 +149,30 @@ test_expect_success 'enable-help=0 hides the tab and the page' '
 	grep "Status: 404" tmp
 '
 
+# --- Side-by-side diff percent-encodes a file path into its links -----------
+# A file name is repository content and may contain a quote, which would
+# otherwise break out of the href attribute of the line-number links.
+test_expect_success 'ssdiff percent-encodes a quoted file path' '
+	mkrepo repos/xss 1 &&
+	name=$(printf "x\047y.txt") &&
+	(
+		cd repos/xss &&
+		printf "a\nb\n" >"$name" &&
+		git add -A &&
+		git commit -m add &&
+		printf "a\nc\n" >"$name" &&
+		git commit -am change
+	) &&
+	{
+		echo "virtual-root=/" &&
+		echo "cache-size=0" &&
+		echo "repo.url=xss" &&
+		echo "repo.path=$PWD/repos/xss/.git"
+	} >xssrc &&
+	sha=$(git -C repos/xss rev-parse HEAD) &&
+	CGIT_CONFIG="$PWD/xssrc" QUERY_STRING="url=xss/diff/&id=$sha&ss=1" cgit >tmp &&
+	grep "tree/x%27y.txt" tmp &&
+	! grep "href=.[^>]*x.y.txt.[^>]*>" tmp
+'
+
 test_done