Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Harden the request path, scan and error recovery
Diffstat (limited to 'tests')
| -rwxr-xr-x | tests/t0205-config.sh | 6 | |
| -rwxr-xr-x | tests/t0301-security.sh | 31 |
2 files changed, 29 insertions, 8 deletions
diff --git a/tests/t0205-config.sh b/tests/t0205-config.sh index 26231af..4691b8f 100755 --- a/tests/t0205-config.sh +++ b/tests/t0205-config.sh @@ -2,7 +2,7 @@ # Checks what the configuration parser reports on stderr. A key it does not # know, a repo key before any repository and a filter set by a scanned -# repository without trust-scan-filters are each ignored with a warning naming +# repository without trust-scan-config are each ignored with a warning naming # the key, a repo filter in the main cgitrc passes without one, a repository # whose path is missing answers 404 on every page, and a config cgit fully # understands stays silent. @@ -52,12 +52,12 @@ test_expect_success 'a filter in a scanned repository is reported without its fl } >scanrc && CGIT_CONFIG="$PWD/scanrc" QUERY_STRING="url=foo.git/commit/" cgit >tmp 2>err && grep "<div class=.commit-subject.>commit 5" tmp && - grep "Ignoring commit-filter in $PWD/scan/foo.git/: trust-scan-filters is not set" err + grep "Ignoring commit-filter in $PWD/scan/foo.git/: trust-scan-config is not set" err ' test_expect_success 'the flag lets a scanned repository set its filters' ' { - echo "trust-scan-filters=1" && + echo "trust-scan-config=1" && cat scanrc } >scanrc-on && CGIT_CONFIG="$PWD/scanrc-on" QUERY_STRING="url=foo.git/commit/" cgit >tmp 2>err && diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 6d6d493..ece60f1 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -242,11 +242,12 @@ test_expect_success 'name-sorted branches are unaffected' ' grep "</html>" tmp ' -# module-link is a template and scan-path lets a repository set its own from -# a cgitrc in the tree, so handing that string to printf let the owner of a -# scanned repository crash the process, or read stack memory into the served -# page, merely by adding conversions past the two that are filled. The tests -# after the fixture also pin down the templates that must keep working. +# module-link is a template and a trusted scan lets a repository set its own +# from a cgitrc in the tree, so handing that string to printf let the owner +# of a scanned repository crash the process, or read stack memory into the +# served page, merely by adding conversions past the two that are filled. +# The tests after the fixture also pin down the templates that must keep +# working. test_expect_success 'set up a submodule fixture with a hostile module-link' ' mkrepo repos/modlink 1 && ( @@ -261,6 +262,7 @@ test_expect_success 'set up a submodule fixture with a hostile module-link' ' { echo "virtual-root=/" && echo "cache-size=0" && + echo "trust-scan-config=1" && echo "scan-path=$PWD/scan" } >modlinkrc ' @@ -313,6 +315,25 @@ test_expect_success 'a doubled percent in a module-link renders as one' ' grep "href=./m/submod/%/$sub." tmp ' +# An unknown page under a repository used to reach the page header with no +# head resolved and crash in the branch switcher. +test_expect_success 'an unknown page under a repository answers 404 with its header' ' + cgit_url "foo/nonsense/" >tmp && + grep "^Status: 404 Not Found" tmp && + grep "Invalid request" tmp && + grep "<select name=.h. " tmp +' + +test_expect_success 'a clone endpoint with http clone off answers the same way' ' + { + echo "enable-http-clone=0" && + cat cgitrc + } >noclonerc && + CGIT_CONFIG="$PWD/noclonerc" QUERY_STRING="url=foo/info/refs" cgit >tmp && + grep "^Status: 404 Not Found" tmp && + grep "<select name=.h. " tmp +' + # The .gitmodules file is commit-controlled content, so a derived link may # carry any scheme and any byte an author can commit. Only http and https # may reach an href, and everything lands attribute-escaped. |