Diff options
| -rwxr-xr-x | tests/t0301-security.sh | 46 | |
| -rwxr-xr-x | tests/t0303-robustness.sh | 32 |
2 files changed, 40 insertions, 38 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 5a7f5fb..951cf1e 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -430,12 +430,46 @@ test_expect_success 'the dumb transport serves nothing but objects and packs' ' test_grep "^Content-Type: application/octet-stream$" tmp ' -test_expect_success 'the about page serves nothing above the readme directory' ' - cgit_rc cverc "url=cve/about/../cverc" >tmp && - expect_status 404 tmp && - ! grep "virtual-root" tmp && - cgit_rc cverc "url=cve/about/" >tmp && - grep "readme text" tmp +# The about page shows the readme alone and its links lead into the tree, so +# a path below it names nothing. It once served the files beside the readme, +# from the tree or the disk, so each kind of readme is asked for a file it +# could have handed over, the site's own readme among them. +test_expect_success 'a path below the about page answers 404 for every kind of readme' ' + mkrepo repos/about 1 && + ( + cd repos/about && + echo "readme in the tree" >README && + echo "beside the readme" >notes.txt && + git add README notes.txt && + git update-index --add --cacheinfo 160000,$(git rev-parse HEAD),sub && + git commit -q -m readme + ) && + echo "readme in the repository" >repos/about/.git/README && + mkdir ondisk && + echo "readme on the disk" >ondisk/README && + cgitrc_site aboutrc mimetype.png=image/png "root-readme=$PWD/ondisk/README" \ + repo.url=disk "repo.path=$PWD/repos/about/.git" "repo.readme=$PWD/ondisk/README" \ + repo.url=gitdir "repo.path=$PWD/repos/about/.git" repo.readme=README \ + repo.url=branch "repo.path=$PWD/repos/about/.git" repo.readme=master:README \ + repo.url=head "repo.path=$PWD/repos/about/.git" repo.readme=:README && + while read about path readme + do + cgit_ok aboutrc "$about" >tmp && + test_grep "$readme" tmp && + cgit_rc aboutrc "$about$path" >tmp 2>err && + expect_status 404 tmp && + test_grep "^Content-Type: text/html" tmp && + test_grep ! -e virtual-root -e repositoryformatversion -e "beside the readme" tmp && + test_must_be_empty err || return 1 + done <<-\EOF + url=disk/about/ ../aboutrc readme on the disk + url=gitdir/about/ config readme in the repository + url=branch/about/ notes.txt readme in the tree + url=branch/about/ sub readme in the tree + url=branch/about/ missing.png readme in the tree + url=head/about/ notes.txt readme in the tree + p=about&path= ../aboutrc readme on the disk + EOF ' test_expect_success 'a commit with an empty author renders everywhere' ' diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh index 0bb402f..66f6c5a 100755 --- a/tests/t0303-robustness.sh +++ b/tests/t0303-robustness.sh @@ -259,27 +259,6 @@ test_expect_success 'a commit encoding header is read without its newline' ' grep "<div class=.commit-subject.>caf$(printf "\303\251")<" tmp ' -# The about page shows the readme alone and its links lead into the tree, -# so a path below it names nothing, the site about page included. -test_expect_success 'a path below the about page answers 404' ' - mkrepo repos/about 3 && - ( - cd repos/about && - git update-index --add --cacheinfo 160000,$(git rev-parse HEAD~1),sub && - git commit -m gitlink - ) && - cgitrc_repo aboutrc about mimetype.png=image/png repo.readme=master:file-1 && - for path in sub sub/ missing.png file-1 ../aboutrc - do - cgit_rc aboutrc "url=about/about/$path" >tmp 2>err && - expect_status 404 tmp && - grep "^Content-Type: text/html" tmp && - ! grep fatal err || return 1 - done && - cgit_rc aboutrc "p=about&path=x" >tmp && - expect_status 404 tmp -' - test_expect_success 'a path opening with a colon is refused on the log and patch pages' ' cgit_rc robrc "url=rob/log/:%25x" >tmp && expect_status 400 tmp && @@ -491,17 +470,6 @@ test_expect_success NO_VALGRIND 'a snapshot format whose compressor is missing a expect_status 500 tmp ' -test_expect_success 'a disk readme in the repository directory serves no sibling' ' - mkrepo repos/disk 1 && - echo hello >repos/disk/.git/README && - cgitrc_repo diskrc disk repo.readme=README && - cgit_rc diskrc "url=disk/about/" >tmp && - grep "hello" tmp && - cgit_rc diskrc "url=disk/about/config" >tmp && - expect_status 404 tmp && - ! grep "repositoryformatversion" tmp -' - test_expect_success 'a tag pointing at a tag links the inner tag by id' ' git -C repos/tagged tag -a -m outer outer ann && inner=$(git -C repos/tagged rev-parse ann) && |