Age	Commit message (Collapse)	Author	Lines
16 hours	Add filename* for a download name past ASCII	Bryce Kwon	-3/+24
	The plain, snapshot and blob pages sent a name such as café.txt raw in filename, which a client may read as ISO-8859-1. RFC 6266 has such a name sent again as filename*, percent-encoded in UTF-8, for a client that knows the form, with filename first for one that does not. The extended form carries UTF-8 alone, so a name that is not valid UTF-8 keeps the plain filename by itself.
16 hours	Move the root-readme test to the index tests	Bryce Kwon	-12/+0
	The test reads the index and the site about page, both drawn by ui-repolist.c. Its site had no repositories, so the index it read was the error page, and a readme printed below the list went unseen. The shared repositories give it a real index.
16 hours	Test a repository url in UTF-8	Bryce Kwon	-0/+21
16 hours	Test a file name in UTF-8	Bryce Kwon	-0/+39
16 hours	Test the about path check for each kind of readme	Bryce Kwon	-6/+40
	Three tests exercised the single path check in about_fn, each through one kind of readme, and none through a readme read from the head being browsed.
18 hours	Share the security tests' repeated setup	Bryce Kwon	-36/+35
18 hours	Move the tree grouping test to the tree tests	Bryce Kwon	-17/+4
	Grouping folders first is tree page behaviour rather than a security fix, so it joins the tree tests on a repository of its own.
18 hours	Link a file name of stray bytes percent-encoded	Bryce Kwon	-0/+18
	No test gave a file name invalid UTF-8 or a control byte, which APFS refuses on disk, so the tree is built through the index.
18 hours	Keep the robustness tests to portable shell	Bryce Kwon	-2/+2
	An unquoted $cgitbin breaks in a checkout whose path holds a space, and head -c and head -1 are not POSIX. The status of the disconnected request is still read right after its pipeline, which assumes the shell waits for the left side as dash, bash, ksh and busybox ash all do.
19 hours	Pin the robots.txt rules	Bryce Kwon	-0/+13
	Nothing in tests/ read robots.txt, so dropping the trailing slashes again went unnoticed.
19 hours	Feed the Location header every kind of byte	Bryce Kwon	-0/+13
	Only a benign query had been redirected, so nothing showed that a space, a control byte or a byte past ASCII in the query string is encoded before it reaches the Location header.
19 hours	Test the download names a request chooses	Bryce Kwon	-0/+18
	The plain page's header was the only one fed a newline. A snapshot asked for with h= keeps the name it was requested under, and a blob fetched by id takes any path, so both put visitor bytes into Content-Disposition.
19 hours	Check the empty author on every page it reaches	Bryce Kwon	-9/+22
	The title claimed every page, but only the log, commit and atom pages were asked for. The commit now changes a file, since the patch page leaves out a commit with nothing to show, and its parent is read before the printf, where a failed rev-parse would have gone unnoticed.
19 hours	Test the dumb transport allowlist in one table	Bryce Kwon	-7/+18
	The allowlist was tested in two places, and the 404 alone did not show the transport was live behind the auth filter, since a page that does not exist answers the same. A loose object and HEAD now have to come through, and the planted alternates file is removed even when the test fails, where it used to leave rob borrowing foo's objects.
19 hours	Ask for the two 404 pages with the cache off	Bryce Kwon	-10/+9
	Both requests went through the shared page cache, and the clone one only worked because clone pages are never stored, which is what the cgitrc_copy comment warns of.
19 hours	Check the order of branches at odd objects	Bryce Kwon	-14/+27
	points-at-tree only ever matched its entry in the branch switcher, and points-at-tag was never looked for. Every branch also shared one date, so the age and name sorts gave the same rows, and nothing showed the name setting had applied. The loose refs written by hand need the files backend.
19 hours	Read the surplus conversions from their own page	Bryce Kwon	-6/+3
	The check read the page the previous test had left, and it took any hex where the commit goes and only two of the eight conversions.
19 hours	Try every risky scheme in a .gitmodules url	Bryce Kwon	-12/+29
	Only a lowercase javascript url was tried, so a denylist of that one spelling would have passed. The quote test also read the page the test before it had left.
19 hours	Test request values a page echoes back	Bryce Kwon	-0/+36
	Only %zz%2 had been sent, so nothing showed that markup in the query, the hidden inputs a form carries, the errors naming a refused value or the Host header is escaped on its way back.
19 hours	Check the lone percent sign in the search box	Bryce Kwon	-5/+4
	For a bare q=% only the status was checked, so a decoder that dropped the sign passed.
19 hours	Test markup in refs, names and messages	Bryce Kwon	-0/+54
	No test gave a ref name, a commit or tag message, a note or an ident any markup, and the one hostile file name never reached an attribute. html_txt leaves quotes alone, so a name holding both a quote and a bracket is what tells an attribute written as text.
19 hours	Test the leading slashes stripped from a url	Bryce Kwon	-0/+16
	Nothing showed that every leading slash goes, through url= or PATH_INFO, and one left behind joins the virtual root into a scheme-relative link to another host.
19 hours	Send the advisory payloads through PATH_INFO	Bryce Kwon	-0/+35
	All three shipped server configs hand cgit the path as PATH_INFO, already decoded, yet every hostile path in the tests went through url= instead.
20 hours	Prove the filter saw the hostile file name	Bryce Kwon	-5/+4
	The name also sits in the breadcrumb and the title, so the test passed with the source filter never run, and the missing marker proved nothing. dump.sh echoes its arguments ahead of the body it upper-cases, which shows the name arrived whole as one argument.
20 hours	Check the line links of a side-by-side diff	Bryce Kwon	-9/+17
	The links have been written through html_attr since b8adfd6, so with the percent-encoding dropped a quote came out as an entity the absence check could not match, and the presence check was met by the file links above the diff. The test now reads the line links themselves, for a name holding a hash and a question mark as well.
20 hours	Look for inline handlers on every main page	Bryce Kwon	-4/+15
	Only the commit page was checked, and only for onchange, though a site policy without unsafe-inline blocks every inline handler on any page.
20 hours	Tie each escaped readme to its own payload	Bryce Kwon	-8/+7
	The escaped script tag alone matched either readme, so the markdown page showing the text readme passed.
20 hours	Compare the small blob the plain page serves	Bryce Kwon	-2/+6
	The test took any page holding the word top, with no status checked. The refusal half lives in t0204, so the fixture now says why its limit is set so low.
20 hours	Read the --output refusal from its own request	Bryce Kwon	-10/+10
	The refusal was read from a page the previous test had left, which --run could skip, and both requests went through the shared page cache. The marker is also named apart from the one the filter test plants, so a failure in one cannot fail the other.
20 hours	Check the policy sent with repository bytes	Bryce Kwon	-0/+28
	No test asserted the Content-Security-Policy header, though it is all that keeps script in an SVG from running when the plain page serves it under its own type.
20 hours	Prove the login body is cut at the buffer	Bryce Kwon	-5/+16
	The posted body was 22 bytes, so an unclamped read stopped at its end and nothing overflowed, and the test could not fail. The filter now counts what it was handed from a body larger than the buffer.
8 days	Spell side-by-side in the test comments	Bryce Kwon	-1/+1
8 days	Ask for a url through cgit_url everywhere	Bryce Kwon	-3/+3
8 days	Move the later tests to the config writers	Bryce Kwon	-97/+38
	The one-line request wrappers go with them. Configs with several repositories, a key out of place on purpose, the cache on or no repository of their own stay written out.
9 days	Work out each gitlink's target once	Bryce Kwon	-4/+1
	Test bodies run in the main shell, so the target named in the fixture reaches every check that greps for it.
9 days	Serve both readme escaping checks from one config	Bryce Kwon	-16/+9
9 days	Ask each page that sorts odd branches in one loop	Bryce Kwon	-23/+8
9 days	Write the test filter scripts with write_script	Bryce Kwon	-3/+1
9 days	Drop test lines that add nothing	Bryce Kwon	-1/+0
	The trash directory starts empty and setup.sh already made the cache, the clamp check already fails on a short query, and the commit the setup named is still there to pin.
9 days	Leave two log checks to the log tests	Bryce Kwon	-5/+0
	t0103 already renders foo/log and finds commit 5, and its search for a bracket fails the same way this literal search did if --fixed-strings ever goes.
9 days	Leave the blob size refusals to the limits tests	Bryce Kwon	-22/+5
	t0204 asks the tree, plain, blob and blame pages for one oversized blob and checks the exact status and message, so the looser copy here went.
2026-10-14	Serve only the files a dumb clone asks for	Bryce Kwon	-2/+2
	The object path check let any run of safe characters through, so a spelling such as info//alternates or info/./alternates reached the alternates file the exact name was refused for.
2026-10-03	Describe root-readme as the site's about page	Bryce Kwon	-0/+16
2026-09-29	Answer 404 for any path below the about page	Bryce Kwon	-1/+1
	The about page served every file beside the readme as a page of its own, through the about filter, and answered 200 for directories and missing files alike. Images it passed through came from the root of the default branch whatever the readme's own directory and ref. A readme on disk exposed its whole directory this way.
2026-09-24	Test the advisory classes and name an empty author	Bryce Kwon	-0/+110
	Each class behind cgit's published advisories now has a check against the current code, from a newline in a file name to shell syntax handed to a filter. The feed also treated an ident with an empty name and an empty address as present and wrote an empty person, which Atom forbids.
2026-09-15	Test the hardening pass	Bryce Kwon	-1/+1
2026-09-14	Harden the request path, scan and error recovery	Bryce Kwon	-5/+26
2026-09-07	Clean up the whole tree	Bryce Kwon	-2/+1
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-4/+2
2026-09-06	Remove the auto-submitting selects	Bryce Kwon	-4/+4