Diff options
Diffstat (limited to 'tests')
-rwxr-xr-xtests/t0301-security.sh27
1 file changed, 5 insertions, 22 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index d9ec265..966754b 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -8,15 +8,13 @@
test_description='Check security fixes and fork-specific behaviour'
. ./setup.sh
-# Most of what follows shares one repository and one config, so the fixture
-# carries everything they need at once, a blob over the size limit, readmes
-# holding markup that must not reach the page as markup, and a subdirectory
-# to sort ahead of the files.
+# Some cases below share one repository and one config, so the fixture
+# carries everything they need at once, readmes holding markup that must not
+# reach the page as markup and a subdirectory to sort ahead of the files.
test_expect_success 'set up security fixtures' '
mkrepo repos/sec 1 &&
(
cd repos/sec &&
- dd if=/dev/zero bs=1024 count=4 2>/dev/null | tr "\0" "X" >big.txt &&
printf "# Title\n<script>alert(1)</script>\n" >README.md &&
printf "<script>alert(2)</script>\n" >readme.txt &&
printf "top\n" >afile &&
@@ -29,7 +27,6 @@ test_expect_success 'set up security fixtures' '
echo "virtual-root=/" &&
echo "cache-size=0" &&
echo "max-blob-size=1" &&
- echo "enable-blame=1" &&
echo "enable-tree-group-dirs=1" &&
echo "repo.url=sec" &&
echo "repo.path=$PWD/repos/sec/.git"
@@ -62,23 +59,9 @@ test_expect_success 'a valid id= still renders the log' '
grep -i "commit 5" tmp
'
-# max-blob-size is enforced before the object is read, so every view that
-# would otherwise inline a file has to turn the same one away rather than
-# inflate it first and think better of it afterwards.
-test_expect_success 'tree view refuses an oversized blob' '
- secq "url=sec/tree/big.txt" | grep -iE "exceeds|too large"
-'
-
-test_expect_success 'plain view refuses an oversized blob' '
- secq "url=sec/plain/big.txt" | grep -iE "exceeds|too large|413"
-'
-
-test_expect_success 'blame view refuses an oversized blob' '
- secq "url=sec/blame/big.txt" | grep -iE "exceeds|too large"
-'
-
test_expect_success 'a small blob is still served' '
- secq "url=sec/plain/afile" | grep -F "top"
+ secq "url=sec/plain/afile" >tmp &&
+ grep -F top tmp
'
# A readme is repository content, so with no about filter configured it has