1 file changed, 35 insertions, 0 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 0ac6cb0..47d1a0a 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -8,6 +8,21 @@
 test_description='Check security fixes and fork-specific behaviour'
 . ./setup.sh
 
+# The shipped server configs hand cgit the path as PATH_INFO, which the
+# server has already decoded, so a hostile byte arrives there raw rather
+# than through url=.
+cgit_path() {
+	CGIT_CONFIG="$PWD/$1" PATH_INFO=$2 cgit
+}
+
+cgit_ok_path() {
+	(
+		PATH_INFO=$2 &&
+		export PATH_INFO &&
+		cgit_ok "$1" ""
+	)
+}
+
 # Some cases below share one repository and one config, so the fixture
 # carries everything they need at once, readmes holding markup that must not
 # reach the page as markup and a subdirectory to sort ahead of the files.
@@ -422,6 +437,26 @@ test_expect_success 'shell syntax in a file name reaches a filter as a plain arg
 	test_path_is_missing repos/cve/pwned
 '
 
+test_expect_success 'the advisory payloads fail the same way through PATH_INFO' '
+	cgit_ok_path cverc "/cve/plain/$(printf "crlf\r\nX-Injected: 1.txt")" >tmp &&
+	test_grep ! "^X-Injected" tmp &&
+	test_grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.txt.$" tmp &&
+	for path in /cve/objects/../config /cve/objects/info/../../config /cve/about/../cverc
+	do
+		cgit_path cverc $path >tmp &&
+		test_grep "^Status: 404" tmp &&
+		test_grep ! -e repositoryformatversion -e virtual-root tmp || return 1
+	done &&
+	cgit_ok_path cverc /cve/HEAD >tmp &&
+	test_grep "^ref: refs/heads/master$" tmp &&
+	cgit_ok_path cverc /cve/about/ >tmp &&
+	test_grep "readme text" tmp &&
+	cgit_ok_path cverc "/cve/tree/\$(touch pwned).c" >tmp &&
+	test_grep -F "\$(touch pwned).c X" tmp &&
+	test_path_is_missing pwned &&
+	test_path_is_missing repos/cve/pwned
+'
+
 # An untrusted response hands over repository bytes as they are. An image
 # keeps its own type, SVG among them, so script inside one is held back by
 # the policy alone. The cache listing prints keys visitors chose.