1 file changed, 24 insertions, 3 deletions

diff --git a/tests/t0301-security.sh b/tests/t0301-security.shindex 6ea8d45..7f0bb59 100755--- a/tests/t0301-security.sh+++ b/tests/t0301-security.sh@@ -666,6 +666,26 @@ test_expect_success 'a requested download name cannot split the headers' ' 	test_grep ! "^X-Injected" headers ' +# A download name past ASCII is sent again as filename*, percent-encoded in+# UTF-8, which a client that knows the form reads in place of the plain one.+# A quote, a backslash and a control byte keep their escapes in the plain+# form and are percent-encoded in the other. A name that is not valid UTF-8+# cannot be given as UTF-8, so it keeps the plain form alone.+test_expect_success 'a download name past ASCII is also sent as filename*' '+	blob=$(git -C repos/mk rev-parse HEAD:file-1) &&+	cgit_ok mkrc "url=mk/blob/&id=$blob&path=%22caf%C3%A9%5C%0D%0AX-Injected:%201%01" >tmp &&+	sed -n "1,/^\$/p" tmp >headers &&+	test_grep ! "^X-Injected" headers &&+	grep "^Content-Disposition:" headers >actual &&+	printf "Content-Disposition: inline; filename=\042\134\042caf\303\251\134\134\134r\134nX-Injected: 1?\042; filename*=UTF-8\047\047%%22caf%%C3%%A9%%5C%%0D%%0AX-Injected%%3A%%201%%01\n" >expect &&+	test_cmp expect actual &&+	cgit_ok mkrc "url=mk/blob/&id=$blob&path=bad%FF" >tmp &&+	sed -n "1,/^\$/p" tmp >headers &&+	grep "^Content-Disposition:" headers >actual &&+	printf "Content-Disposition: inline; filename=\042bad\377\042\n" >expect &&+	test_cmp expect actual+'+ # The about page of a repository without a readme sends the visitor on to # the summary with the query string as it arrived, which a server hands over # undecoded, so a byte no header line may carry is encoded on the way out.@@ -712,8 +732,9 @@ test_expect_success 'a file name of stray bytes is linked percent-encoded' '  # A name in UTF-8 is the common case of the same. It goes through the index # as well, so the tree holds the composed form whatever a filesystem makes-# of the name, and each page shows it as it is, the download name included,-# and links it percent-encoded.+# of the name, and each page shows it as it is and links it percent-encoded.+# The download name is sent as it is in filename and percent-encoded in+# filename*. test_expect_success 'a UTF-8 file name is shown as it is and linked percent-encoded' ' 	mkrepo repos/utf8 1 && 	name=$(printf "caf\303\251.txt") &&@@ -738,7 +759,7 @@ test_expect_success 'a UTF-8 file name is shown as it is and linked percent-enco 	test_grep "<code>au revoir$" tmp && 	test_grep ! "href=.[^>]*$name" tmp && 	cgit_ok utf8rc "url=utf8/plain/$encoded" >tmp &&-	test_grep "^Content-Disposition: inline; filename=.$name.$" tmp &&+	test_grep "^Content-Disposition: inline; filename=.$name.; filename\*=UTF-8..$encoded$" tmp && 	strip_headers <tmp >body && 	echo "au revoir" >expect && 	test_cmp expect body &&
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 6ea8d45..7f0bb59 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -666,6 +666,26 @@ test_expect_success 'a requested download name cannot split the headers' '
 	test_grep ! "^X-Injected" headers
 '
 
+# A download name past ASCII is sent again as filename*, percent-encoded in
+# UTF-8, which a client that knows the form reads in place of the plain one.
+# A quote, a backslash and a control byte keep their escapes in the plain
+# form and are percent-encoded in the other. A name that is not valid UTF-8
+# cannot be given as UTF-8, so it keeps the plain form alone.
+test_expect_success 'a download name past ASCII is also sent as filename*' '
+	blob=$(git -C repos/mk rev-parse HEAD:file-1) &&
+	cgit_ok mkrc "url=mk/blob/&id=$blob&path=%22caf%C3%A9%5C%0D%0AX-Injected:%201%01" >tmp &&
+	sed -n "1,/^\$/p" tmp >headers &&
+	test_grep ! "^X-Injected" headers &&
+	grep "^Content-Disposition:" headers >actual &&
+	printf "Content-Disposition: inline; filename=\042\134\042caf\303\251\134\134\134r\134nX-Injected: 1?\042; filename*=UTF-8\047\047%%22caf%%C3%%A9%%5C%%0D%%0AX-Injected%%3A%%201%%01\n" >expect &&
+	test_cmp expect actual &&
+	cgit_ok mkrc "url=mk/blob/&id=$blob&path=bad%FF" >tmp &&
+	sed -n "1,/^\$/p" tmp >headers &&
+	grep "^Content-Disposition:" headers >actual &&
+	printf "Content-Disposition: inline; filename=\042bad\377\042\n" >expect &&
+	test_cmp expect actual
+'
+
 # The about page of a repository without a readme sends the visitor on to
 # the summary with the query string as it arrived, which a server hands over
 # undecoded, so a byte no header line may carry is encoded on the way out.
@@ -712,8 +732,9 @@ test_expect_success 'a file name of stray bytes is linked percent-encoded' '
 
 # A name in UTF-8 is the common case of the same. It goes through the index
 # as well, so the tree holds the composed form whatever a filesystem makes
-# of the name, and each page shows it as it is, the download name included,
-# and links it percent-encoded.
+# of the name, and each page shows it as it is and links it percent-encoded.
+# The download name is sent as it is in filename and percent-encoded in
+# filename*.
 test_expect_success 'a UTF-8 file name is shown as it is and linked percent-encoded' '
 	mkrepo repos/utf8 1 &&
 	name=$(printf "caf\303\251.txt") &&
@@ -738,7 +759,7 @@ test_expect_success 'a UTF-8 file name is shown as it is and linked percent-enco
 	test_grep "<code>au revoir$" tmp &&
 	test_grep ! "href=.[^>]*$name" tmp &&
 	cgit_ok utf8rc "url=utf8/plain/$encoded" >tmp &&
-	test_grep "^Content-Disposition: inline; filename=.$name.$" tmp &&
+	test_grep "^Content-Disposition: inline; filename=.$name.; filename\*=UTF-8..$encoded$" tmp &&
 	strip_headers <tmp >body &&
 	echo "au revoir" >expect &&
 	test_cmp expect body &&