1 file changed, 29 insertions, 1 deletion

diff --git a/tests/t0105-plain.sh b/tests/t0105-plain.shindex 5364a0e..68832da 100755--- a/tests/t0105-plain.sh+++ b/tests/t0105-plain.sh@@ -3,7 +3,8 @@ # The plain page hands over a repository's own bytes. A file with no better # guess is served as text unless its bytes look binary, a directory answers # with a bare listing of links, and a path that names nothing comes back as-# a 404 rather than an empty document.+# a 404 rather than an empty document. The blob page, which does the same+# for an object named by its id, is checked here too.  test_description='Check content on plain page' . ./setup.sh@@ -108,6 +109,33 @@ test_expect_success 'a blob whose bytes look binary is served as octet-stream' ' 	sed "/^$/q" tmp | grep "^Content-Type: application/octet-stream$" ' +# The blob page hands over one object's bytes by its id alone, under the+# same untrusted headers as plain, with nothing in a tree to name a type by.+test_expect_success 'the blob page serves an object by its id' '+	blob=$(git -C repos/foo rev-parse master:file-1) &&+	cgit_ok_url "foo/blob/&id=$blob" >tmp &&+	sed "/^$/q" tmp >headers &&+	test_grep "^Content-Type: text/plain; charset=UTF-8$" headers &&+	test_grep "^X-Content-Type-Options: nosniff$" headers &&+	test_grep "^Content-Security-Policy: default-src .none.$" headers &&+	strip_headers <tmp >body &&+	git -C repos/foo cat-file blob $blob >expect &&+	test_cmp expect body+'++test_expect_success 'the blob page serves binary bytes as octet-stream' '+	blob=$(printf "\\000\\001" | git -C repos/foo hash-object -w --stdin) &&+	cgit_ok_url "foo/blob/&id=$blob" >tmp &&+	sed "/^$/q" tmp >headers &&+	test_grep "^Content-Type: application/octet-stream$" headers+'++test_expect_success 'the blob page refuses an id that is no object id' '+	cgit_url "foo/blob/&id=xyz" >tmp &&+	test_grep "^Status: 404" tmp &&+	test_grep "<div class=.error.>Bad object id: xyz</div>" tmp+'+ # RFC 7303 names the XML types by an xml subtype or a +xml suffix, and those # take a charset like text does. A type that only spells xml inside a word, # as the Office formats do, is binary and gets none.
diff --git a/tests/t0105-plain.sh b/tests/t0105-plain.sh
index 5364a0e..68832da 100755
--- a/tests/t0105-plain.sh
+++ b/tests/t0105-plain.sh
@@ -3,7 +3,8 @@
 # The plain page hands over a repository's own bytes. A file with no better
 # guess is served as text unless its bytes look binary, a directory answers
 # with a bare listing of links, and a path that names nothing comes back as
-# a 404 rather than an empty document.
+# a 404 rather than an empty document. The blob page, which does the same
+# for an object named by its id, is checked here too.
 
 test_description='Check content on plain page'
 . ./setup.sh
@@ -108,6 +109,33 @@ test_expect_success 'a blob whose bytes look binary is served as octet-stream' '
 	sed "/^$/q" tmp | grep "^Content-Type: application/octet-stream$"
 '
 
+# The blob page hands over one object's bytes by its id alone, under the
+# same untrusted headers as plain, with nothing in a tree to name a type by.
+test_expect_success 'the blob page serves an object by its id' '
+	blob=$(git -C repos/foo rev-parse master:file-1) &&
+	cgit_ok_url "foo/blob/&id=$blob" >tmp &&
+	sed "/^$/q" tmp >headers &&
+	test_grep "^Content-Type: text/plain; charset=UTF-8$" headers &&
+	test_grep "^X-Content-Type-Options: nosniff$" headers &&
+	test_grep "^Content-Security-Policy: default-src .none.$" headers &&
+	strip_headers <tmp >body &&
+	git -C repos/foo cat-file blob $blob >expect &&
+	test_cmp expect body
+'
+
+test_expect_success 'the blob page serves binary bytes as octet-stream' '
+	blob=$(printf "\\000\\001" | git -C repos/foo hash-object -w --stdin) &&
+	cgit_ok_url "foo/blob/&id=$blob" >tmp &&
+	sed "/^$/q" tmp >headers &&
+	test_grep "^Content-Type: application/octet-stream$" headers
+'
+
+test_expect_success 'the blob page refuses an id that is no object id' '
+	cgit_url "foo/blob/&id=xyz" >tmp &&
+	test_grep "^Status: 404" tmp &&
+	test_grep "<div class=.error.>Bad object id: xyz</div>" tmp
+'
+
 # RFC 7303 names the XML types by an xml subtype or a +xml suffix, and those
 # take a charset like text does. A type that only spells xml inside a word,
 # as the Office formats do, is binary and gets none.