1 file changed, 11 insertions, 0 deletions
diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh
index b53a38d..07f7c09 100755
--- a/tests/t0303-robustness.sh
+++ b/tests/t0303-robustness.sh
@@ -855,4 +855,15 @@ test_expect_success 'a notes ref that names no tree is passed over' '
 	grep "^Status: 404" tmp
 '
 
+# A scanned repository names its own default branch, which the index stats
+# below the repository to date it, so the name is held to what a ref may be.
+test_expect_success 'a scanned defbranch cannot name a path outside the repository' '
+	mkdir -p secret &&
+	touch -t 200001010000 secret/file &&
+	echo "defbranch=../../../../secret/file" >scan/b.git/cgitrc &&
+	CGIT_CONFIG="$PWD/gitcfgrc" QUERY_STRING="url=" cgit >tmp &&
+	grep ">b.git</a>" tmp &&
+	! grep "data-ut=.946" tmp
+'
+
 test_done