Diff options
| -rw-r--r-- | source/html.c | 17 | |
| -rw-r--r-- | source/html.h | 7 | |
| -rw-r--r-- | source/ui-shared.c | 4 | |
| -rwxr-xr-x | tests/t0102-summary.sh | 36 |
4 files changed, 61 insertions, 3 deletions
diff --git a/source/html.c b/source/html.c index bc7a722..ce9344d 100644 --- a/source/html.c +++ b/source/html.c @@ -404,6 +404,23 @@ void cgit_add_url_path(struct strbuf *sb, const char *txt) } } +void html_attr_url(const char *txt) +{ + struct strbuf url = STRBUF_INIT; + + // These are the bytes RFC 3986 allows in no part of a url. + for (; *txt; txt++) { + unsigned char c = *txt; + + if (c <= ' ' || c >= 0x7f || strchr("\"<>\\^`{|}", c)) + strbuf_addstr(&url, url_escape_table[c]); + else + strbuf_addch(&url, c); + } + html_attr(url.buf); + strbuf_release(&url); +} + void html_url_arg(const char *txt) { const char *p = txt; diff --git a/source/html.h b/source/html.h index d3cd8fe..4c16f85 100644 --- a/source/html.h +++ b/source/html.h @@ -84,6 +84,13 @@ extern void html_url_path(const char *txt); */ extern void cgit_add_url_path(struct strbuf *sb, const char *txt); +/* + * Escape a whole url given in the configuration, such as a clone url, for an + * attribute value. Only a byte no url may carry is percent-encoded, so the + * scheme, the delimiters and any escape the url was written with are kept. + */ +extern void html_attr_url(const char *txt); + extern void html_url_arg(const char *txt); extern void html_header_arg_in_quotes(const char *txt); extern void html_header_query(const char *txt); diff --git a/source/ui-shared.c b/source/ui-shared.c index 985f33d..9e3757d 100644 --- a/source/ui-shared.c +++ b/source/ui-shared.c @@ -243,7 +243,7 @@ static void print_rel_vcs_link(const char *url) if (!has_uri_scheme(url)) return; html("<link rel='vcs-git' href='"); - html_attr(url); + html_attr_url(url); html("' title='"); html_attr(ctx.repo->name); html(" Git repository'>\n"); @@ -1736,7 +1736,7 @@ void cgit_print_clone_row(const char *url, int colspan) html("<a rel='vcs-git' title='"); html_attr(ctx.repo->name); html(" Git repository' href='"); - html_attr(href); + html_attr_url(href); html("'>"); html_txt(url); html("</a></td></tr>\n"); diff --git a/tests/t0102-summary.sh b/tests/t0102-summary.sh index 632698c..a7c2c42 100755 --- a/tests/t0102-summary.sh +++ b/tests/t0102-summary.sh @@ -76,7 +76,7 @@ test_expect_success 'a space in the repository url stays inside one clone url' ' cgit_ok_url "with+space" >tmp && test_grep "clone-url.><a rel=.vcs-git. title=.with space Git repository. href=./with%20space/.>git://example.org/with space.git</a>" tmp && test $(grep -c "class=.clone-url." tmp) = 1 && - test_grep "<link rel=.vcs-git. href=.git://example.org/with.*space\.git. title=.with space Git repository.>" tmp && + test_grep "<link rel=.vcs-git. href=.git://example.org/with%20space\.git. title=.with space Git repository.>" tmp && test $(grep -c "<link rel=.vcs-git." tmp) = 1 && cgitrc_repo spacerc "with space" "clone-prefix=https://a git://b" && cgit_ok spacerc "url=with+space" >tmp && @@ -85,6 +85,40 @@ test_expect_success 'a space in the repository url stays inside one clone url' ' test $(grep -c "class=.clone-url." tmp) = 2 ' +# A clone url is shown as written, but linked with each byte a url cannot +# carry percent-encoded. Its scheme, its delimiters and any escape it was +# written with are left as they are. +test_expect_success 'a clone url is linked percent-encoded' ' + url=$(printf "d\303\251p\303\264t") && + encoded=d%C3%A9p%C3%B4t && + cgitrc_repo encrc "$url" "repo.path=$PWD/repos/foo/.git" \ + "repo.clone-url=git+ssh://example.org/my%20repos/\$CGIT_REPO_URL.git https://example.org/\$CGIT_REPO_URL" && + cgit_ok encrc "url=$encoded" >tmp && + test_grep "<link rel=.vcs-git. href=.git+ssh://example.org/my%20repos/$encoded\.git. title=.$url Git repository.>" tmp && + test_grep "<link rel=.vcs-git. href=.https://example.org/$encoded. title=.$url Git repository.>" tmp && + test_grep "title=.$url Git repository. href=.https://example.org/$encoded.>git+ssh://example.org/my%20repos/$url\.git</a>" tmp && + test_grep "title=.$url Git repository. href=.https://example.org/$encoded.>https://example.org/$url</a>" tmp && + test_grep ! "href=.[^ >]*$url" tmp && + cgit_ok spacerc "url=with+space" >tmp && + test_grep "<link rel=.vcs-git. href=.https://a/with%20space. title=.with space Git repository.>" tmp && + test_grep "<link rel=.vcs-git. href=.git://b/with%20space. title=.with space Git repository.>" tmp && + test_grep "href=.https://a/with%20space.>git://b/with space</a>" tmp +' + +# The macros read the request as well, so a clone url built from the Host +# header has to stay inside the attribute it is linked from. +test_expect_success 'a clone url from the request stays inside its attribute' ' + cgitrc_repo hostrc foo "repo.clone-url=https://\$HTTP_HOST/\$CGIT_REPO_URL" && + ( + HTTP_HOST="h'\''\"<x>" && + export HTTP_HOST && + cgit_ok hostrc "url=foo" >tmp + ) && + test_grep "<link rel=.vcs-git. href=.https://h'%22%3Cx%3E/foo. title=.foo Git repository.>" tmp && + test_grep "href=.https://h'%22%3Cx%3E/foo.>https://h..<x>/foo</a>" tmp && + test_grep ! "<x>" tmp +' + # A repository can turn the global clone-url off with an empty one of its own. # Neither its summary nor the page an empty repository gets then draws a Clone # heading over no rows. |