Diff options
| -rwxr-xr-x | tests/t0301-security.sh | 25 |
1 file changed, 9 insertions, 16 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 01dd793..45d472d 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -67,31 +67,24 @@ test_expect_success 'markdown readme without a filter is escaped as plain text' echo "cache-size=0" && echo "repo.url=md" && echo "repo.path=$PWD/repos/sec/.git" && - echo "repo.readme=master:README.md" - } >secmdrc && - CGIT_CONFIG="$PWD/secmdrc" QUERY_STRING="url=md/about/" cgit >tmp && + echo "repo.readme=master:README.md" && + echo "repo.url=txt" && + echo "repo.path=$PWD/repos/sec/.git" && + echo "repo.readme=master:readme.txt" + } >secreadmerc && + CGIT_CONFIG="$PWD/secreadmerc" QUERY_STRING="url=md/about/" cgit >tmp && grep "pre class=.plaintext." tmp && grep "<script>" tmp && ! grep "<script>alert(1)</script>" tmp ' -test_expect_success 'non-markdown readme without a filter is escaped' ' - { - echo "virtual-root=/" && - echo "cache-size=0" && - echo "repo.url=txt" && - echo "repo.path=$PWD/repos/sec/.git" && - echo "repo.readme=master:readme.txt" - } >sectxtrc && - CGIT_CONFIG="$PWD/sectxtrc" QUERY_STRING="url=txt/about/" cgit >tmp && +test_expect_success 'non-markdown readme without a filter is escaped as plain text' ' + CGIT_CONFIG="$PWD/secreadmerc" QUERY_STRING="url=txt/about/" cgit >tmp && + grep "pre class=.plaintext." tmp && grep "<script>" tmp && ! grep "<script>alert(2)</script>" tmp ' -test_expect_success 'non-markdown readme keeps its line structure' ' - grep "pre class=.plaintext." tmp -' - # root-readme is the site's own file rather than repository content, so it # goes out as written, on an about page of its own. test_expect_success 'root-readme without a filter is its own page, as written' ' |