Age	Commit message (Collapse)	Author	Lines
26 hours	Check that link-commits encodes a rule capture	Bryce Kwon	-0/+7
	Every capture the checks used was hex or digits, which encoding leaves alone, so the filter passed with url_encode gone and a broader rule could then have broken out of the href.
26 hours	Check that markup inside a token is escaped	Bryce Kwon	-0/+3
	Every escape the checks looked at sat between tokens or in the tail a lexer left untagged, so a filter that escaped only those would have passed with a string literal reaching the page raw.
26 hours	Time each hostile readme at two lengths	Bryce Kwon	-17/+48
	One ten second budget covered several inputs, so a failure did not say which had regressed, and it allowed ten times the second a readme is held to while leaving a slow host little room. A linear render costs four times as much at four times the length and a quadratic one sixteen, whatever the host. The cap on unclosed brackets had no check at all, and the line of \h' escapes timed nothing that is bounded.
26 hours	Check that a link's fragment is escaped	Bryce Kwon	-0/+3
26 hours	Prove a control byte cannot hide a link's scheme	Bryce Kwon	-2/+9
	The old check split the scheme with a newline, which ends the line before a link can form, so it passed with the strip removed.
37 hours	Fetch avatar icons without a Referer	Bryce Kwon	-0/+1
	The icons came from Gravatar or Libravatar with the page's url as the Referer, so the service learned which repositories and commits each visitor looked at.
3 days	Read the login form table as layout	Bryce Kwon	-0/+1
6 days	Name a missing Lua module in the error log	Bryce Kwon	-0/+17
6 days	Log failed logins	Bryce Kwon	-0/+7
	The login posts outside any repository, so the log line names the repository by the page its signed way back leads to.
6 days	Say that logging in needs https	Bryce Kwon	-1/+12
	Only HTTPS=on counts, the same test cgit makes before it writes an https link of its own.
6 days	Tell a signed-in visitor they have no access	Bryce Kwon	-0/+7
6 days	Say when logins are unavailable	Bryce Kwon	-1/+37
	The way back was signed part way through the form, so while the secret's directory did not exist, or a library was missing, cgit's error landed inside the hidden input and the page broke off there with no fields.
6 days	Keep counting across a split ordered list	Bryce Kwon	-0/+7
8 days	Find a capitalised extension's lexer again	Bryce Kwon	-5/+12
	Scintillua's detect() matches an extension by its case, and the fallback e227d1f dropped had lowercased it, so MAIN.C and SETUP.PY lost their colour. The fake lexer now answers only for the suffixes it knows, as Scintillua does, which is what lets the check see it.
9 days	Write a session's expiry in whole seconds	Bryce Kwon	-0/+11
	On Lua 5.3 and later a length worked out with a fraction, such as 1.5 * 24 * 60 * 60, is a float, so the signed expiry came out as 1793609024.0, which validate_value refuses, and every login failed. Max-Age took the same .0, which makes a browser ignore it.
9 days	Set the Lua prerequisite once for every test	Bryce Kwon	-25/+16
	setup.sh already asks the binary, so the seven scripts that each turned the answer into a prerequisite now share one. test-lib names the missing prerequisite beside every test it skips, so the notes that cgit lacks Lua go, while the ones announcing a fallback stay. Every script that listed the standalone interpreters asked for the same ceiling, so lib.sh now builds that list for all of them.
9 days	Share the request helpers in the auth checks	Bryce Kwon	-77/+49
	The two identical posts for an unknown user become one, and no two checks share a name, so a failure report points at a single check.
9 days	Let an unmirrored sink fail the way Lua would	Bryce Kwon	-12/+0
9 days	Drop the auth stubs no check reaches	Bryce Kwon	-20/+6
	Every check replaces get_secret, the only caller of posix.sys.stat, link and unlink, and nothing outside the harness calls preload.
9 days	Drop auth guards for input cgit never sends	Bryce Kwon	-3/+4
	cgit passes an empty string, never nil, when a request names no repository, so the check that the index stays up proved nothing, and auth-file in fact refuses the index too while its repos file cannot be read. A session_seconds of 0 signs a session that has expired by the time it comes back, so it needs no branch of its own in set_cookie.
9 days	Strip control characters from the location alone	Bryce Kwon	-2/+0
	set_cookie only ever writes an empty value or a token secure_value built from url-encoded text, digits and hex, so stripping it changed nothing.
9 days	Take a signed cookie apart with one match	Bryce Kwon	-0/+1
	The loop let a valid cookie through with a field appended, a doubled separator or a zero in front of its expiry. The payload now carries the expiry as written, so only the spelling secure_value issues verifies.
9 days	Drop a highlighter check that tested the harness	Bryce Kwon	-6/+0
	The filter hands a NUL through untouched, and only the harness's copy of cgit's sink cut the text there, so the check would have failed the day the filter replaced NULs the way about-render does.
9 days	Drop the highlighter's extension fallback	Bryce Kwon	-14/+5
	The table of extensions and the second lookup served only a Scintillua with no detect(), which now leaves every file uncoloured but escaped. The fake detect() names a lexer after the file's suffix, so every test lexer is reached through it.
9 days	Drop a stray blank line from about-render's tests	Bryce Kwon	-1/+0
9 days	Drop the readme hooks that nothing reads	Bryce Kwon	-5/+4
	Nothing in assets/ or in README's list of hooks reads a fenced block's data-lang or the manpage class on a man page's wrapper.
12 days	Render the man pages that generators write	Bryce Kwon	-2/+69
	DocBook, pod2man and hand written pages leaked roff onto the page. Font escapes inside no fill blocks, comments, layout escapes such as \% and \c, the colours and half line moves around DocBook's links, and the requests and macro definitions their preambles open with all showed through. Those now draw nothing, the common named characters and strings render, .EX and pod2man's .Vb read as code, a .TP tag takes a line of its own and the alternating font macros switch fonts between their arguments. Anything rarer still falls back to its text.
12 days	Render more of the markdown seen in readmes	Bryce Kwon	-0/+26
	A line of equals signs or dashes under a paragraph now makes a heading of it, as on GitHub, instead of running into its text, and any other rule ends the paragraph. Four spaces or a tab start a code block, and an escaped pipe stays in its table cell. A link opening with two slashes or backslashes in any mix leads to another site, so it renders as text like the plain scheme relative one already did.
12 days	Keep a readme whole past a NUL byte	Bryce Kwon	-6/+5
	cgit takes filter output through a C string sink that stops at the first NUL, so a readme holding one lost everything after it. Each NUL now shows as U+FFFD, as a browser would show it.
2026-10-24	Say when a login fails, and line up the form	Bryce Kwon	-1/+11
	A wrong password sent the reader back to the same empty form, which looked no different from a crash. The redirect now carries a flag the form reads, the same for an unknown user as for a wrong password, and the form leaves the flag out of the way back it signs.
2026-10-24	Colour css properties and pseudo-classes	Bryce Kwon	-16/+21
	Scintillua's css lexer tags them with names the map had no row for, so they came out as plain text.
2026-10-22	Escape the same characters in the highlighter	Bryce Kwon	-0/+29
	A lexer may hand back the bytes of one separator, or the CR and LF of a line ending, in different tokens, so line endings become line feeds before lexing and the separators are escaped once the tokens are joined.
2026-10-17	Give the trim timing check room for a slow host	Bryce Kwon	-2/+3
	The about-render unit test bounds three renders at one second to catch the cubic trim coming back. They take 0.1 s on a fast host and three seconds on a slow one, where the check failed, while the old code took minutes, so ten seconds still tells the two apart.
2026-10-05	Find a script's lexer from its shebang line	Bryce Kwon	-4/+11
	Scintillua's detect reads the first line as well as the name, and without it hooks, bin scripts and anything else lacking an extension stayed plain.
2026-10-05	Ship the example tracker links commented out	Bryce Kwon	-7/+22
	An unedited copy sent every #123, Closes: and Bug: mark to bugs.example.com, a link that is wrong for every site.
2026-10-05	Name the auth cookie __Host- where it can be	Bryce Kwon	-26/+51
	Without the prefix any host under the same domain could set a cgitauth cookie of its own, signing a visitor in as someone else or out.
2026-10-05	End a session when its account's hash changes	Bryce Kwon	-4/+20
	A session stayed good for its whole week after the password changed or the account went away, which is when ending it matters most.
2026-10-04	Load auth libraries only when a request needs one	Bryce Kwon	-0/+13
	Required at the top, a missing luaossl or luaposix failed every request to the site, public pages included, and each public page paid to load both.
2026-10-04	Spend a missing account's login on a real hash	Bryce Kwon	-36/+68
	The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once.
2026-10-04	Turn down passwords past 256 bytes unchecked	Bryce Kwon	-0/+22
	SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt.
2026-10-04	Read the auth cookie in linear time	Bryce Kwon	-0/+10
	Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well.
2026-10-04	Offer avatars at twice the size to dense screens	Bryce Kwon	-0/+1
	The 13 pixel icon came out blurred on the high density screens most phones and laptops have.
2026-10-04	Hash avatar addresses with SHA-256	Bryce Kwon	-3/+5
	Gravatar's documentation now describes SHA-256 hashes on gravatar.com alone, and Libravatar has long accepted them beside MD5.
2026-10-04	Mark avatar icons as decorative	Bryce Kwon	-3/+1
	A screen reader announced the service's name before every author.
2026-10-04	Unwrap an avatar address in linear time	Bryce Kwon	-0/+7
	An author email of 16,000 "<" took three quarters of a second per log row, and one of 64,000 took twelve seconds.
2026-10-03	Draw no avatar when luaossl is missing	Bryce Kwon	-2/+11
	The require at the top raised as cgit loaded the filter, so every page that lists an author stopped at its first author cell with an error.
2026-10-02	Give readme headings anchors like GitHub's	Bryce Kwon	-8/+21
	A readme's links to its own sections, as in a table of contents, had nothing on the page to land on.
2026-10-02	Keep underscores inside words out of emphasis	Bryce Kwon	-0/+6
2026-10-02	Let character references through to the browser	Bryce Kwon	-0/+9
	Decoding them here instead would mean carrying every named reference HTML defines, while the browser already knows them all.
2026-10-01	Honour backslash escapes in readmes	Bryce Kwon	-0/+9