Diff options
Diffstat (limited to 'tests')
| -rwxr-xr-x | tests/t0110-snapshot.sh | 14 | |
| -rwxr-xr-x | tests/t0301-security.sh | 27 |
2 files changed, 38 insertions, 3 deletions
diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.sh index ded694d..0ada26d 100755 --- a/tests/t0110-snapshot.sh +++ b/tests/t0110-snapshot.sh @@ -430,4 +430,18 @@ test_expect_success 'a signature past max-blob-size is refused' ' cgit_ok sigrc "url=signed/snapshot/signed-one.tar.gz.asc" >tmp ' +# A tag named in UTF-8 gives a snapshot name past ASCII, which is sent as it +# is in filename and percent-encoded in filename*. +test_expect_success 'a snapshot name in UTF-8 is also sent as filename*' ' + mkrepo repos/accent 1 && + tag=$(printf "caf\303\251") && + git -C repos/accent tag "$tag" && + cgitrc_repo accentrc accent snapshots=tar && + cgit_ok accentrc "url=accent/refs/tags" >tmp && + test_grep "<a href=./accent/snapshot/accent-caf%C3%A9.tar.>accent-$tag.tar</a>" tmp && + cgit_ok accentrc "url=accent/snapshot/accent-caf%C3%A9.tar" >tmp && + sed "/^$/q" tmp >headers && + test_grep "^Content-Disposition: inline; filename=.accent-$tag.tar.; filename\*=UTF-8..accent-caf%C3%A9.tar$" headers +' + test_done diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 6ea8d45..7f0bb59 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -666,6 +666,26 @@ test_expect_success 'a requested download name cannot split the headers' ' test_grep ! "^X-Injected" headers ' +# A download name past ASCII is sent again as filename*, percent-encoded in +# UTF-8, which a client that knows the form reads in place of the plain one. +# A quote, a backslash and a control byte keep their escapes in the plain +# form and are percent-encoded in the other. A name that is not valid UTF-8 +# cannot be given as UTF-8, so it keeps the plain form alone. +test_expect_success 'a download name past ASCII is also sent as filename*' ' + blob=$(git -C repos/mk rev-parse HEAD:file-1) && + cgit_ok mkrc "url=mk/blob/&id=$blob&path=%22caf%C3%A9%5C%0D%0AX-Injected:%201%01" >tmp && + sed -n "1,/^\$/p" tmp >headers && + test_grep ! "^X-Injected" headers && + grep "^Content-Disposition:" headers >actual && + printf "Content-Disposition: inline; filename=\042\134\042caf\303\251\134\134\134r\134nX-Injected: 1?\042; filename*=UTF-8\047\047%%22caf%%C3%%A9%%5C%%0D%%0AX-Injected%%3A%%201%%01\n" >expect && + test_cmp expect actual && + cgit_ok mkrc "url=mk/blob/&id=$blob&path=bad%FF" >tmp && + sed -n "1,/^\$/p" tmp >headers && + grep "^Content-Disposition:" headers >actual && + printf "Content-Disposition: inline; filename=\042bad\377\042\n" >expect && + test_cmp expect actual +' + # The about page of a repository without a readme sends the visitor on to # the summary with the query string as it arrived, which a server hands over # undecoded, so a byte no header line may carry is encoded on the way out. @@ -712,8 +732,9 @@ test_expect_success 'a file name of stray bytes is linked percent-encoded' ' # A name in UTF-8 is the common case of the same. It goes through the index # as well, so the tree holds the composed form whatever a filesystem makes -# of the name, and each page shows it as it is, the download name included, -# and links it percent-encoded. +# of the name, and each page shows it as it is and links it percent-encoded. +# The download name is sent as it is in filename and percent-encoded in +# filename*. test_expect_success 'a UTF-8 file name is shown as it is and linked percent-encoded' ' mkrepo repos/utf8 1 && name=$(printf "caf\303\251.txt") && @@ -738,7 +759,7 @@ test_expect_success 'a UTF-8 file name is shown as it is and linked percent-enco test_grep "<code>au revoir$" tmp && test_grep ! "href=.[^>]*$name" tmp && cgit_ok utf8rc "url=utf8/plain/$encoded" >tmp && - test_grep "^Content-Disposition: inline; filename=.$name.$" tmp && + test_grep "^Content-Disposition: inline; filename=.$name.; filename\*=UTF-8..$encoded$" tmp && strip_headers <tmp >body && echo "au revoir" >expect && test_cmp expect body && |