1 file changed, 32 insertions, 0 deletions
diff --git a/tests/t0501-about-render.sh b/tests/t0501-about-render.sh
index d432dd2..53aac41 100755
--- a/tests/t0501-about-render.sh
+++ b/tests/t0501-about-render.sh
@@ -72,6 +72,9 @@ test_expect_success 'point cgit at it through the about filter' '
 	repo.path=$PWD/repos/md/.git
 	repo.readme=:NOTES
 	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
+	repo.url=noreadme
+	repo.path=$PWD/repos/md/.git
+	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
 	EOF
 '
 
@@ -116,6 +119,35 @@ test_expect_success CGIT_LUA_LPEG 'the about page shows plain text as it is' '
 	test_grep "<pre class=.plaintext.>Plain &lt;b&gt;notes&lt;/b&gt; &amp; more" tmp
 '
 
+# The filter makes no about page of its own, so a repository without a
+# readme line sends its about page on to the summary.
+test_expect_success CGIT_LUA 'the about page wants a readme line, even with the filter' '
+	cgit_url "noreadme/about/" >tmp &&
+	test_grep "^Status: 302" tmp &&
+	test_grep "^Location: /noreadme/$" tmp
+'
+
+# The site readme has no tree behind it, which leaves the scheme check as
+# the only guard on its links.
+test_expect_success CGIT_LUA_LPEG 'the site readme turns no unsafe link into one' '
+	cat >root.md <<-\EOF &&
+	# Site
+
+	A [bad](javascript:alert%281%29) link and a [good](https://example.com/) one.
+	EOF
+	cat >rootrc <<-EOF &&
+	virtual-root=/
+	cache-size=0
+	root-readme=$PWD/root.md
+	about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
+	EOF
+	cgit_ok rootrc "p=about" >tmp &&
+	test_grep "<h1 id=.site.>Site</h1>" tmp &&
+	test_grep "<a href=.https://example.com/.>good</a>" tmp &&
+	test_grep "A bad link" tmp &&
+	test_grep ! "javascript:" tmp
+'
+
 test_expect_success CGIT_LUA 'without lpeg every readme is served escaped' '
 	echo "[cgit] Unable to load lpeg, so markdown and man pages show as plain text" >expect &&
 	without_lua_modules cgit_url "md/about/" >tmp 2>err &&