Diff options
Diffstat (limited to 'tests/t0301-security.sh')
| -rwxr-xr-x | tests/t0301-security.sh | 25 |
1 file changed, 18 insertions, 7 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 9b887d4..555eb89 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -415,13 +415,24 @@ test_expect_success 'a posted length past any buffer is clamped' ' test $(cat received) = 10 ' -test_expect_success 'the dumb transport refuses a path that climbs out' ' - cgit_rc cverc "url=cve/objects/../config" >tmp && - grep "^Status: 404" tmp && - ! grep "repositoryformatversion" tmp && - cgit_rc cverc "url=cve/objects/info/../../config" >tmp && - grep "^Status: 404" tmp && - ! grep "repositoryformatversion" tmp +# The dumb transport serves a file below objects only by the shape a client +# asks for, so no spelling of a path climbs out or reaches the alternates +# file, which names object directories by their path on the server. +test_expect_success 'the dumb transport serves nothing but objects and packs' ' + echo "$PWD/repos/foo/.git/objects" >repos/cve/.git/objects/info/alternates && + test_when_finished "rm repos/cve/.git/objects/info/alternates" && + for path in ../config info/../../config info/alternates info//alternates \ + info/./alternates ./info/alternates info/Alternates /info/alternates + do + cgit_rc cverc "url=cve/objects/$path" >tmp && + test_grep "^Status: 404" tmp && + test_grep ! -e repositoryformatversion -e repos/foo tmp || return 1 + done && + cgit_ok cverc "url=cve/HEAD" >tmp && + test_grep "^ref: refs/heads/master$" tmp && + blob=$(git -C repos/cve rev-parse HEAD:file-1) && + cgit_ok cverc "url=cve/objects/$(test_oid_to_path $blob)" >tmp && + test_grep "^Content-Type: application/octet-stream$" tmp ' test_expect_success 'the about page serves nothing above the readme directory' ' |