Diff options
| -rwxr-xr-x | tests/t0301-security.sh | 25 | |
| -rwxr-xr-x | tests/t0303-robustness.sh | 17 |
2 files changed, 18 insertions, 24 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 9b887d4..555eb89 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -415,13 +415,24 @@ test_expect_success 'a posted length past any buffer is clamped' ' test $(cat received) = 10 ' -test_expect_success 'the dumb transport refuses a path that climbs out' ' - cgit_rc cverc "url=cve/objects/../config" >tmp && - grep "^Status: 404" tmp && - ! grep "repositoryformatversion" tmp && - cgit_rc cverc "url=cve/objects/info/../../config" >tmp && - grep "^Status: 404" tmp && - ! grep "repositoryformatversion" tmp +# The dumb transport serves a file below objects only by the shape a client +# asks for, so no spelling of a path climbs out or reaches the alternates +# file, which names object directories by their path on the server. +test_expect_success 'the dumb transport serves nothing but objects and packs' ' + echo "$PWD/repos/foo/.git/objects" >repos/cve/.git/objects/info/alternates && + test_when_finished "rm repos/cve/.git/objects/info/alternates" && + for path in ../config info/../../config info/alternates info//alternates \ + info/./alternates ./info/alternates info/Alternates /info/alternates + do + cgit_rc cverc "url=cve/objects/$path" >tmp && + test_grep "^Status: 404" tmp && + test_grep ! -e repositoryformatversion -e repos/foo tmp || return 1 + done && + cgit_ok cverc "url=cve/HEAD" >tmp && + test_grep "^ref: refs/heads/master$" tmp && + blob=$(git -C repos/cve rev-parse HEAD:file-1) && + cgit_ok cverc "url=cve/objects/$(test_oid_to_path $blob)" >tmp && + test_grep "^Content-Type: application/octet-stream$" tmp ' test_expect_success 'the about page serves nothing above the readme directory' ' diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh index bb405f1..7e79b87 100755 --- a/tests/t0303-robustness.sh +++ b/tests/t0303-robustness.sh @@ -633,23 +633,6 @@ test_expect_success 'the dumb transport sends a file with its size' ' cmp body repos/rob/.git/objects/pack/$pack ' -# The alternates file lists object directories by their path on the server, -# which a client fetching over http cannot use and should not learn. -test_expect_success 'the dumb transport withholds the alternates file' ' - mkdir -p repos/rob/.git/objects/info && - echo "$PWD/repos/foo/.git/objects" >repos/rob/.git/objects/info/alternates && - for path in info/alternates info//alternates info/./alternates ./info/alternates \ - info/Alternates /info/alternates - do - cgit_rc robrc "url=rob/objects/$path" >tmp && - grep "^Status: 404" tmp && - ! grep "repos/foo" tmp || return 1 - done && - rm repos/rob/.git/objects/info/alternates && - cgit_rc robrc "url=rob/objects/info/packs" >tmp && - grep "^Status: 200" tmp -' - # A reftable repository keeps only a placeholder in its HEAD file, so the # branch a client is to check out has to come from the refs instead. test_expect_success 'the dumb transport answers HEAD from the refs' ' |