1 file changed, 29 insertions, 0 deletions
diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.sh
index 6d59686..ded694d 100755
--- a/tests/t0110-snapshot.sh
+++ b/tests/t0110-snapshot.sh
@@ -210,6 +210,35 @@ test_expect_success 'an id naming no commit is refused' '
 	grep "<div class=.error.>Bad object id: nosuchref</div>" tmp
 '
 
+test_expect_success 'set up a repo with a tag holding a slash' '
+	mkrepo repos/names 2 &&
+	git -C repos/names tag rel/1 &&
+	cgitrc_repo namesrc names snapshots=tar
+'
+
+# The stem becomes the leading directory of every member of the archive, so
+# a name holding a slash is refused even where it spells a ref. Such a ref
+# is linked under a dashed name instead.
+test_expect_success 'a snapshot name holding a slash is refused' '
+	for name in rel/1 :/../../..
+	do
+		cgit_rc namesrc "url=names/snapshot/$name.tar" >tmp &&
+		grep "^Status: 404" tmp &&
+		grep "<div class=.error.>Not found</div>" tmp || return 1
+	done &&
+	cgit_ok namesrc "url=names/snapshot/names-master.tar" >tmp
+'
+
+# Only a ref is worked back from a file name, since the wider revision syntax
+# can walk the whole history for a match. The name holds no slash, so it
+# reaches that check rather than the one above.
+test_expect_success 'a snapshot name in revision syntax is refused' '
+	cgit_rc namesrc "url=names/snapshot/master~1.tar" >tmp &&
+	grep "^Status: 404" tmp &&
+	grep "<div class=.error.>Not found</div>" tmp &&
+	cgit_ok namesrc "url=names/snapshot/master.tar" >tmp
+'
+
 # Two tags differing only in the case of their v keep it on both names. Two
 # loose files differing in case alone cannot coexist on a case-insensitive
 # filesystem, so the first is packed before the second goes in, and both are