1 file changed, 17 insertions, 9 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 64129b6..8cb1b5b 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -129,23 +129,31 @@ test_expect_success 'tree groups directories before files' '
 
 # A file name is repository content and may hold a quote, which would break
 # out of the href attribute on the line number links of a side-by-side diff,
-# so the path is percent-encoded on its way into them.
-test_expect_success 'ssdiff percent-encodes a quoted file path' '
+# or a hash or question mark, which the attribute escaping leaves alone and
+# a browser would read as the end of the path. So the path is percent-encoded
+# on its way into them.
+test_expect_success 'ssdiff percent-encodes the file path in its line links' '
 	mkrepo repos/xss 1 &&
-	name=$(printf "x\047y.txt") &&
+	quoted=$(printf "x\047y.txt") &&
 	(
 		cd repos/xss &&
-		printf "a\nb\n" >"$name" &&
+		printf "a\nb\n" >"$quoted" &&
+		printf "a\nb\n" >"p#q?.txt" &&
 		git add -A &&
 		git commit -m add &&
-		printf "a\nc\n" >"$name" &&
+		printf "a\nc\n" >"$quoted" &&
+		printf "a\nc\n" >"p#q?.txt" &&
 		git commit -am change
 	) &&
 	cgitrc_repo xssrc xss &&
-	sha=$(git -C repos/xss rev-parse HEAD) &&
-	cgit_rc xssrc "url=xss/diff/&id=$sha&ss=1" >tmp &&
-	grep "tree/x%27y.txt" tmp &&
-	! grep "href=.[^>]*x.y.txt.[^>]*>" tmp
+	old=$(git -C repos/xss rev-parse HEAD~1) &&
+	new=$(git -C repos/xss rev-parse HEAD) &&
+	cgit_ok xssrc "url=xss/diff/&id=$new&ss=1" >tmp &&
+	for path in x%27y.txt p%23q%3F.txt
+	do
+		test_grep "<td class=.lineno.><a href=./xss/tree/$path?id=$old#n2.>2</a></td>" tmp &&
+		test_grep "<td class=.lineno.><a href=./xss/tree/$path?id=$new#n2.>2</a></td>" tmp || return 1
+	done
 '
 
 # git itself will write a commit with an empty message, so the log and the