Age	Commit message (Collapse)	Author	Lines
5 days	Test blame on a binary file	Bryce Kwon	-0/+21
	t0104's binary fixture never turns blame on, so neither the blame page's own refusal nor the missing link on the file's page had a test.
5 days	Test a HEAD aimed outside its repository	Bryce Kwon	-0/+18
	The defbranch check had a test while its twin for a crafted HEAD, which the index reads the same way to date a repository, had none.
5 days	Test the dumb transport allowlist in one table	Bryce Kwon	-17/+0
	The allowlist was tested in two places, and the 404 alone did not show the transport was live behind the auth filter, since a page that does not exist answers the same. A loose object and HEAD now have to come through, and the planted alternates file is removed even when the test fails, where it used to leave rob borrowing foo's objects.
5 days	Test every scanned key that waits on trust	Bryce Kwon	-23/+79
	Only head-content and logo-link were tried, so logo, clone-url and both module-link forms could have been taken from a repository's own cgitrc unnoticed. A trusted control shows each value would reach the page, and the refused disk readmes are now checked against a file that would show if read.
5 days	Test the snapshot slash rule on a real ref	Bryce Kwon	-4/+20
	Every candidate name meets check_refname_format first, which refuses the old payload, so the slash rule never answered it and could go unnoticed. A tag holding a slash reaches it, and a name in revision syntax without a slash now pins the ref name check of its own.
5 days	Catch an ignored SIGPIPE under any shell	Bryce Kwon	-9/+15
	dash reports a write to a closed pipe as an I/O error and never names a broken pipe, so where sh is dash the test passed with the reset removed. The writer now leaves a marker when it outlives the closed pipe, which it can only do with the signal ignored. That holds under dash, bash and ksh.
12 days	Check only what the racy filter tests can promise	Bryce Kwon	-3/+7
	Both tests passed or failed with the order in which cgit and the exec filter happened to run, about one run in four under UBSan.
12 days	Move the later tests to the config writers	Bryce Kwon	-129/+90
	The one-line request wrappers go with them. Configs with several repositories, a key out of place on purpose, the cache on or no repository of their own stay written out.
12 days	Ask for each path below the about page in one test	Bryce Kwon	-22/+12
	All of them stop at the same early return in about_fn, so each now gets the status, the html error page and a clean log.
13 days	Write the test filter scripts with write_script	Bryce Kwon	-6/+2
13 days	Drop test lines that add nothing	Bryce Kwon	-2/+0
	The trash directory starts empty and setup.sh already made the cache, the clamp check already fails on a short query, and the commit the setup named is still there to pin.
13 days	Leave two log checks to the log tests	Bryce Kwon	-7/+0
	t0103 already renders foo/log and finds commit 5, and its search for a bracket fails the same way this literal search did if --fixed-strings ever goes.
13 days	Require a whole page when a filter exits early	Bryce Kwon	-2/+3
	When a filter cannot run, cgit dies mid-page with its Status line already out, so the check passed with no filter at all. That is the case wherever true lives only in /bin, as on busybox. true now comes from the PATH, and the page has to reach its end.
2026-10-15	Hold a scanned defbranch to a ref name	Bryce Kwon	-0/+11
	The index stats the default branch below the repository to date it, and a scanned repository sets its own defbranch, which was not held to what a ref may hold, so one spelled as a path reached a file outside.
2026-10-15	Pass over a notes ref that names no tree	Bryce Kwon	-0/+20
	A pusher can point refs/notes/commits or a signature notes ref at any object, and git dies loading one that is no tree, which ended every page of the repository, the dumb transport included.
2026-10-15	Show an odd pushed date rather than die on it	Bryce Kwon	-0/+39
	A date past what the system holds, a zone that is no hhmm offset, or a date earlier than its own westward offset all made git die inside show_date, which took the summary, refs, log, commit and feed pages of the repository down. They are now clamped as git's own log clamps them.
2026-10-14	Check the id before the page chrome resolves it	Bryce Kwon	-0/+12
	The chrome renders on an error page too, where the id had just been refused for using the wider revision syntax, and then looked it up anyway. A :/pattern id walks the whole history for a match.
2026-10-14	Serve only the files a dumb clone asks for	Bryce Kwon	-3/+7
	The object path check let any run of safe characters through, so a spelling such as info//alternates or info/./alternates reached the alternates file the exact name was refused for.
2026-10-14	Give a repository without a path no age	Bryce Kwon	-0/+10
	The index built its paths from a NULL repo.path, which the C library prints as "(null)", so it looked for refs under that name in the working directory.
2026-10-11	Say why an oversized readme leaves about empty	Bryce Kwon	-0/+15
	A readme past max-blob-size is never read, which left the about page with an empty block and no word of why.
2026-10-11	Date a reftable repository on the index	Bryce Kwon	-0/+5
	The idle column falls back on the mtime of the branch's loose ref or of packed-refs, and a reftable repository has neither, so its cell stayed empty. Git rewrites reftable/tables.list on every ref update.
2026-10-11	Answer dumb-clone HEAD from the ref store	Bryce Kwon	-0/+26
	A reftable repository keeps only a placeholder in its HEAD file, so a dumb clone was told HEAD named refs/heads/.invalid and checked nothing out. HEAD is now answered the way git's http-backend answers it.
2026-10-08	Peel an annotated tag before looking for a readme	Bryce Kwon	-0/+14
	Tag links carry the tag name as the head, so on any page reached from an annotated tag the about tab vanished and the about page redirected to the summary.
2026-10-08	Encode repository urls and the feed branch	Bryce Kwon	-0/+6
	Links built from the repository url, among them the description link on the index and the Atom and refs links, wrote it as configured, so a name holding a space, '#' or '?' broke them. The feed link in the page head did the same with the branch, which turned a '+' into a space.
2026-10-03	Leave readme out of what scan-path fixes	Bryce Kwon	-0/+10
2026-09-29	Answer 404 for any path below the about page	Bryce Kwon	-10/+21
	The about page served every file beside the readme as a page of its own, through the about filter, and answered 200 for directories and missing files alike. Images it passed through came from the root of the default branch whatever the readme's own directory and ref. A readme on disk exposed its whole directory this way.
2026-09-27	Name the right file and error in the scan logs	Bryce Kwon	-0/+28
	A failed stat logged the directory rather than the entry inside it, and a project list that failed to read printed strerror of the flag ferror returns, which names an unrelated error.
2026-09-27	Skip an indented comment in the mimetype file	Bryce Kwon	-0/+6
	Only a hash in the first column marked a comment, so an indented one was read as the type "#" for every word after it. The manual already describes comments by their first non-blank character.
2026-09-27	Keep the error of a request that dies mid capture	Bryce Kwon	-0/+29
	The commit and diff pages collect each file's body before printing it, and a die in git while one was collected wrote the error page into that body, which was never sent, so the visitor got a page cut off mid table.
2026-09-27	Gate a readme ending in a colon like a disk path	Bryce Kwon	-0/+10
	trust-scan-config passed any readme holding a colon as a tracked file, while the parser takes one only when a path follows the colon, so a scanned repository could still name a file on disk outside itself.
2026-09-25	Keep a repository with an empty url ignored	Bryce Kwon	-1/+6
	The field resets at the end of cgit_add_repo cleared the ignore flag that the empty url branch had just set, so such a repository was listed on the index and selectable with ?r=, where every link to it read the byte before its url.
2026-09-25	Mark a page behind an auth filter private	Bryce Kwon	-0/+22
	Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
2026-09-24	End a request quietly when the client has gone	Bryce Kwon	-0/+16
	A write that failed with EPIPE on an uncached page died into an error page, which died again at exit when the page could not be sent either, and git logged a recursion warning on every dropped connection. A filter that exits early fails a write the same way, so the quiet exit is kept for writes that reach the client itself.
2026-09-24	Keep option-like branch names out of the switcher	Bryce Kwon	-0/+7
	Such a name is refused as a head before git could read it as an option, and the fallback branch already skips it, so the switcher offered a choice that led only to an error page.
2026-09-23	Walk a path on the blob page from a commit id	Bryce Kwon	-0/+15
	With both an id and a path the blob page handed back the raw object the id named, so a commit id gave the commit text itself, while the plain page looked the path up in that commit's tree. A tag is peeled to its commit on the way, and the README example of a pinned commit now uses a form the request checks accept.
2026-09-23	Keep the query string across the about redirects	Bryce Kwon	-0/+13
	The hop to the trailing-slash form of the about page, and the hop back to the summary of a repository without a readme, were built from the path alone, so a request for the about page of another branch landed on the default one. The query goes into the Location line as the client sent it, with any byte a header cannot carry percent-encoded.
2026-09-23	Withhold the alternates file on the dumb transport	Bryce Kwon	-0/+13
	It lists object directories by their path on the server, which a client fetching over http can neither use nor needs to learn. The http-alternates file written for such clients still goes out.
2026-09-22	Send a clone file with its size in whole batches	Bryce Kwon	-0/+15
	The dumb transport read a pack four kilobytes at a time through stdio and sent it without a length, so a client could not tell a cut-off transfer from a complete one.
2026-09-22	Gate html serving behind trust-scan-config	Bryce Kwon	-3/+39
	enable-html-serving makes the plain page send a repository file as text/html on the site's own origin, with no nosniff and no policy, so a scanned repository could switch it on from its git config or cgitrc without trust-scan-config and run script against every visitor. The warning for a key read from git config also named a null repository, because repo->path was set only after that file had been read.
2026-09-21	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-1/+1
2026-09-15	Test the hardening pass	Bryce Kwon	-0/+471