2 files changed, 16 insertions, 0 deletions
diff --git a/source/ui-shared.c b/source/ui-shared.c
index f3d815f..a0a0664 100644
--- a/source/ui-shared.c
+++ b/source/ui-shared.c
@@ -419,6 +419,10 @@ static const struct object_id *pinned_oid(void)
 
 	if (!ctx.repo || !ctx.qry.has_oid || !ctx.qry.oid || !ctx.qry.head)
 		return NULL;
+	// The chrome renders on an error page too, where the id was refused
+	// before any command could look it up, so it is checked here as well.
+	if (!cgit_valid_rev(ctx.qry.oid))
+		return NULL;
 	if (repo_get_oid(the_repository, ctx.qry.oid, &oid) ||
 		repo_get_oid(the_repository, ctx.qry.head, &head_oid))
 		return NULL;
diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh
index 005c6cd..05237c6 100755
--- a/tests/t0303-robustness.sh
+++ b/tests/t0303-robustness.sh
@@ -784,4 +784,16 @@ test_expect_success 'a readme past max-blob-size is reported on the about page'
 	grep "The readme is larger than max-blob-size (1 KB)" tmp
 '
 
+# The chrome names a pinned commit in the title, and on an error page the id
+# that was just refused must not be looked up to get there, since the wider
+# revision syntax walks the whole history for a match.
+test_expect_success 'the error page does not resolve the id it refused' '
+	sha=$(git -C repos/rob rev-parse HEAD~1) &&
+	robq "url=rob/log/&id=$sha" >tmp &&
+	grep "<title>.* @ " tmp &&
+	robq "url=rob/log/&id=%3A/commit" >tmp &&
+	grep "^Status: 400" tmp &&
+	! grep "<title>.* @ " tmp
+'
+
 test_done