Diff options
| -rw-r--r-- | source/parsing.c | 20 | |
| -rw-r--r-- | source/ui-shared.c | 2 | |
| -rw-r--r-- | tests/t0200-security.sh | 22 |
3 files changed, 36 insertions, 8 deletions
diff --git a/source/parsing.c b/source/parsing.c index ee2b65c..a7e46de 100644 --- a/source/parsing.c +++ b/source/parsing.c @@ -175,14 +175,20 @@ struct commitinfo *cgit_parse_commit(struct commit *commit) p = next_header_line(p); while (p && *p == '\n') p++; - if (!p) - return ret; - t = strchrnul(p, '\n'); - ret->subject = substr(p, t); - while (*t == '\n') - t++; - ret->msg = xstrdup(t); + if (p) { + t = strchrnul(p, '\n'); + ret->subject = substr(p, t); + while (*t == '\n') + t++; + ret->msg = xstrdup(t); + } else { + // A crafted commit can end right after its headers with no + // message. Keep subject and msg as empty strings so callers + // can treat them as text unconditionally. + ret->subject = xstrdup(""); + ret->msg = xstrdup(""); + } reencode(&ret->author, ret->msg_encoding, PAGE_ENCODING); reencode(&ret->author_email, ret->msg_encoding, PAGE_ENCODING); diff --git a/source/ui-shared.c b/source/ui-shared.c index 7687ae1..3ec4f55 100644 --- a/source/ui-shared.c +++ b/source/ui-shared.c @@ -436,7 +436,7 @@ void cgit_commit_link(const char *name, const char *title, const char *class, html("follow=1"); } html("'>"); - if (name[0] != '\0') { + if (name && name[0] != '\0') { if (strlen(name) > ctx.cfg.max_msg_len && ctx.cfg.max_msg_len >= 15) { html_ntxt(name, ctx.cfg.max_msg_len - 3); html("..."); diff --git a/tests/t0200-security.sh b/tests/t0200-security.sh index 4eee9ae..83cdbfd 100644 --- a/tests/t0200-security.sh +++ b/tests/t0200-security.sh @@ -175,4 +175,26 @@ test_expect_success 'ssdiff percent-encodes a quoted file path' ' ! grep "href=.[^>]*x.y.txt.[^>]*>" tmp ' +# --- A commit with no message must not crash the history views -------------- +test_expect_success 'a message-less commit renders without crashing' ' + mkrepo repos/nomsg 1 && + ( + cd repos/nomsg && + tree=$(git write-tree) && + printf "tree %s\nauthor a <a@b> 1735689600 +0000\ncommitter a <a@b> 1735689600 +0000\n" "$tree" >raw && + cid=$(git hash-object -t commit -w raw) && + git update-ref refs/heads/master "$cid" + ) && + { + echo "virtual-root=/" && + echo "cache-size=0" && + echo "repo.url=nomsg" && + echo "repo.path=$PWD/repos/nomsg/.git" + } >nomsgrc && + CGIT_CONFIG="$PWD/nomsgrc" QUERY_STRING="url=nomsg/log/&showmsg=1" cgit >tmp && + grep "no commit message" tmp && + CGIT_CONFIG="$PWD/nomsgrc" QUERY_STRING="url=nomsg/" cgit >tmp && + grep "no commit message" tmp +' + test_done |