Diff options
Diffstat (limited to '')
| -rwxr-xr-x | tests/t0301-security.sh | 27 |
1 file changed, 5 insertions, 22 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index d9ec265..966754b 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -8,15 +8,13 @@ test_description='Check security fixes and fork-specific behaviour' . ./setup.sh -# Most of what follows shares one repository and one config, so the fixture -# carries everything they need at once, a blob over the size limit, readmes -# holding markup that must not reach the page as markup, and a subdirectory -# to sort ahead of the files. +# Some cases below share one repository and one config, so the fixture +# carries everything they need at once, readmes holding markup that must not +# reach the page as markup and a subdirectory to sort ahead of the files. test_expect_success 'set up security fixtures' ' mkrepo repos/sec 1 && ( cd repos/sec && - dd if=/dev/zero bs=1024 count=4 2>/dev/null | tr "\0" "X" >big.txt && printf "# Title\n<script>alert(1)</script>\n" >README.md && printf "<script>alert(2)</script>\n" >readme.txt && printf "top\n" >afile && @@ -29,7 +27,6 @@ test_expect_success 'set up security fixtures' ' echo "virtual-root=/" && echo "cache-size=0" && echo "max-blob-size=1" && - echo "enable-blame=1" && echo "enable-tree-group-dirs=1" && echo "repo.url=sec" && echo "repo.path=$PWD/repos/sec/.git" @@ -62,23 +59,9 @@ test_expect_success 'a valid id= still renders the log' ' grep -i "commit 5" tmp ' -# max-blob-size is enforced before the object is read, so every view that -# would otherwise inline a file has to turn the same one away rather than -# inflate it first and think better of it afterwards. -test_expect_success 'tree view refuses an oversized blob' ' - secq "url=sec/tree/big.txt" | grep -iE "exceeds|too large" -' - -test_expect_success 'plain view refuses an oversized blob' ' - secq "url=sec/plain/big.txt" | grep -iE "exceeds|too large|413" -' - -test_expect_success 'blame view refuses an oversized blob' ' - secq "url=sec/blame/big.txt" | grep -iE "exceeds|too large" -' - test_expect_success 'a small blob is still served' ' - secq "url=sec/plain/afile" | grep -F "top" + secq "url=sec/plain/afile" >tmp && + grep -F top tmp ' # A readme is repository content, so with no about filter configured it has |
