1 file changed, 28 insertions, 0 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 835e922..ff1c241 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -401,4 +401,32 @@ test_expect_success 'shell syntax in a file name reaches a filter as a plain arg
 	! test -e repos/cve/pwned
 '
 
+# An untrusted response hands over repository bytes as they are. An image
+# keeps its own type, SVG among them, so script inside one is held back by
+# the policy alone. The cache listing prints keys visitors chose.
+test_expect_success 'repository bytes go out under a policy that loads nothing' '
+	mkrepo repos/svg 1 &&
+	(
+		cd repos/svg &&
+		echo "<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(1)</script></svg>" >x.svg &&
+		git add x.svg &&
+		git commit -m svg
+	) &&
+	cgitrc_repo svgrc svg mimetype.svg=image/svg+xml &&
+	cgit_ok svgrc "url=svg/plain/x.svg" >tmp &&
+	test_grep "^Content-Type: image/svg+xml;" tmp &&
+	test_grep "<script>alert(1)</script>" tmp &&
+	for page in plain/x.svg blob/x.svg
+	do
+		cgit_ok svgrc "url=svg/$page" >tmp &&
+		test_grep "^X-Content-Type-Options: nosniff$" tmp &&
+		test_grep "^Content-Security-Policy: default-src .none.$" tmp || return 1
+	done &&
+	cgitrc_copy lscacherc &&
+	cgit_ok lscacherc "p=ls_cache" >tmp &&
+	test_grep "^Content-Type: text/plain;" tmp &&
+	test_grep "^X-Content-Type-Options: nosniff$" tmp &&
+	test_grep "^Content-Security-Policy: default-src .none.$" tmp
+'
+
 test_done