Diff options
| -rwxr-xr-x | tests/t0501-about-render.sh | 32 |
1 file changed, 32 insertions, 0 deletions
diff --git a/tests/t0501-about-render.sh b/tests/t0501-about-render.sh index d432dd2..53aac41 100755 --- a/tests/t0501-about-render.sh +++ b/tests/t0501-about-render.sh @@ -72,6 +72,9 @@ test_expect_success 'point cgit at it through the about filter' ' repo.path=$PWD/repos/md/.git repo.readme=:NOTES repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua + repo.url=noreadme + repo.path=$PWD/repos/md/.git + repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua EOF ' @@ -116,6 +119,35 @@ test_expect_success CGIT_LUA_LPEG 'the about page shows plain text as it is' ' test_grep "<pre class=.plaintext.>Plain <b>notes</b> & more" tmp ' +# The filter makes no about page of its own, so a repository without a +# readme line sends its about page on to the summary. +test_expect_success CGIT_LUA 'the about page wants a readme line, even with the filter' ' + cgit_url "noreadme/about/" >tmp && + test_grep "^Status: 302" tmp && + test_grep "^Location: /noreadme/$" tmp +' + +# The site readme has no tree behind it, which leaves the scheme check as +# the only guard on its links. +test_expect_success CGIT_LUA_LPEG 'the site readme turns no unsafe link into one' ' + cat >root.md <<-\EOF && + # Site + + A [bad](javascript:alert%281%29) link and a [good](https://example.com/) one. + EOF + cat >rootrc <<-EOF && + virtual-root=/ + cache-size=0 + root-readme=$PWD/root.md + about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua + EOF + cgit_ok rootrc "p=about" >tmp && + test_grep "<h1 id=.site.>Site</h1>" tmp && + test_grep "<a href=.https://example.com/.>good</a>" tmp && + test_grep "A bad link" tmp && + test_grep ! "javascript:" tmp +' + test_expect_success CGIT_LUA 'without lpeg every readme is served escaped' ' echo "[cgit] Unable to load lpeg, so markdown and man pages show as plain text" >expect && without_lua_modules cgit_url "md/about/" >tmp 2>err && |