Age	Commit message (Collapse)	Author	Lines
38 hours	Read the expected blob through its own tag	Bryce Kwon	-5/+7
	The expected content was "more" only because an earlier test had rewritten file-1, and the next test reused that file and the tag. The tag.gpgsign override did nothing, since test-lib already keeps the user's config out.
38 hours	Give the symlink cycle a scan directory of its own	Bryce Kwon	-3/+11
	The expected count of 2 held only because earlier tests had made a.git and b.git and one of them had dropped b.git's cgitrc.
38 hours	Drop the loose directory chain bound	Bryce Kwon	-13/+0
	The count was bounded only from above, and loosely, so a page listing no directories passed, as would a limit of 16. t0104's long directory chain test already pins the bound exactly.
39 hours	Check the row of a symlink to a large blob	Bryce Kwon	-4/+6
	The blob came out of a pipeline whose failure would have left it empty and the test passing, and nothing looked at the row itself. head -c is not POSIX either.
39 hours	Restore HEAD however the fallback test ends	Bryce Kwon	-10/+7
	HEAD was put back inside the && chain after cgit ran, so a failure left repos/rob on a missing branch for every later test. The switcher check also read the page this test left, and now runs in the same test.
39 hours	Count the answers to a corrupt blob in a diff	Bryce Kwon	-3/+4
	Unlike its siblings the test never counted status lines, so a second page after the first went unnoticed. The headers are out by the time the diff is collected, so the one answer stays a 200 holding the error.
39 hours	Prove the cache keeps what the ttl test refuses	Bryce Kwon	-11/+14
	cache_process bypasses a ttl of 0 and fails quietly in many ways, so with a dead cache the test passed whatever ttl the page got. A second config that keeps the same page for ever now has to replay it, from a cache of its own, since slots are keyed on the request alone.
39 hours	Pair each absence check with what has to be there	Bryce Kwon	-12/+17
	Every page ends in </html>, the 404 for no repositories included, and an index, an error page or a page cut short lacks most things, so the path-less repository, the empty url, the page without an auth filter and the refused id each now show the page that was meant to render.
39 hours	Expect working pages beside a notes ref at a blob	Bryce Kwon	-10/+7
	The loop asserted only absences, so a 404 or any error but the die text passed, and the final 404 is also what a name that resolves to nothing gets.
39 hours	Follow the link from an outer tag to its inner one	Bryce Kwon	-4/+6
	The test opened the inner tag by id and never looked at the outer tag's page or the link the title is about.
39 hours	Name what a missing parent really does to the log	Bryce Kwon	-8/+14
	The log walks the history before it prints a row, so nothing ahead of the gap ever renders and the title promised more than the page shows. The test also took its gap from the shared repository, where HEAD~2 was a given commit only because of tests run before it.
39 hours	Make the early-exit filter meet a closed pipe	Bryce Kwon	-7/+10
	The email filter was handed a few bytes, which usually sit in the pipe before the filter has even exited, so a cgit that died of SIGPIPE passed most runs. A source filter handed more than a pipe holds has to see the write fail.
39 hours	Hold the mailmap to max-blob-size	Bryce Kwon	-0/+31
	git's read_mailmap_blob inflates the whole blob, so a pusher could make every page of a repository read as much as they liked. git reads a note and the .gitmodules file whole as well, and capping those would mean bounding the lookups where the log, commit and tree pages make them, so the manual names them instead. Nothing tested that mailmap.file and mailmap.blob are ignored either.
39 hours	Test markup in a scanned repository's own words	Bryce Kwon	-0/+26
	A scanned repository sets its description, owner and section without trust, and no test gave them any markup.
39 hours	Test blame on a binary file	Bryce Kwon	-0/+21
	t0104's binary fixture never turns blame on, so neither the blame page's own refusal nor the missing link on the file's page had a test.
39 hours	Test a HEAD aimed outside its repository	Bryce Kwon	-0/+18
	The defbranch check had a test while its twin for a crafted HEAD, which the index reads the same way to date a repository, had none.
39 hours	Pin the robots.txt rules	Bryce Kwon	-0/+13
	Nothing in tests/ read robots.txt, so dropping the trailing slashes again went unnoticed.
39 hours	Feed the Location header every kind of byte	Bryce Kwon	-0/+13
	Only a benign query had been redirected, so nothing showed that a space, a control byte or a byte past ASCII in the query string is encoded before it reaches the Location header.
39 hours	Test the download names a request chooses	Bryce Kwon	-0/+18
	The plain page's header was the only one fed a newline. A snapshot asked for with h= keeps the name it was requested under, and a blob fetched by id takes any path, so both put visitor bytes into Content-Disposition.
39 hours	Check the empty author on every page it reaches	Bryce Kwon	-9/+22
	The title claimed every page, but only the log, commit and atom pages were asked for. The commit now changes a file, since the patch page leaves out a commit with nothing to show, and its parent is read before the printf, where a failed rev-parse would have gone unnoticed.
39 hours	Test the dumb transport allowlist in one table	Bryce Kwon	-24/+18
	The allowlist was tested in two places, and the 404 alone did not show the transport was live behind the auth filter, since a page that does not exist answers the same. A loose object and HEAD now have to come through, and the planted alternates file is removed even when the test fails, where it used to leave rob borrowing foo's objects.
39 hours	Ask for the two 404 pages with the cache off	Bryce Kwon	-10/+9
	Both requests went through the shared page cache, and the clone one only worked because clone pages are never stored, which is what the cgitrc_copy comment warns of.
39 hours	Check the order of branches at odd objects	Bryce Kwon	-14/+27
	points-at-tree only ever matched its entry in the branch switcher, and points-at-tag was never looked for. Every branch also shared one date, so the age and name sorts gave the same rows, and nothing showed the name setting had applied. The loose refs written by hand need the files backend.
39 hours	Read the surplus conversions from their own page	Bryce Kwon	-6/+3
	The check read the page the previous test had left, and it took any hex where the commit goes and only two of the eight conversions.
39 hours	Try every risky scheme in a .gitmodules url	Bryce Kwon	-12/+29
	Only a lowercase javascript url was tried, so a denylist of that one spelling would have passed. The quote test also read the page the test before it had left.
39 hours	Test request values a page echoes back	Bryce Kwon	-0/+36
	Only %zz%2 had been sent, so nothing showed that markup in the query, the hidden inputs a form carries, the errors naming a refused value or the Host header is escaped on its way back.
39 hours	Check the lone percent sign in the search box	Bryce Kwon	-5/+4
	For a bare q=% only the status was checked, so a decoder that dropped the sign passed.
39 hours	Test markup in refs, names and messages	Bryce Kwon	-0/+54
	No test gave a ref name, a commit or tag message, a note or an ident any markup, and the one hostile file name never reached an attribute. html_txt leaves quotes alone, so a name holding both a quote and a bracket is what tells an attribute written as text.
39 hours	Test the leading slashes stripped from a url	Bryce Kwon	-0/+16
	Nothing showed that every leading slash goes, through url= or PATH_INFO, and one left behind joins the virtual root into a scheme-relative link to another host.
39 hours	Send the advisory payloads through PATH_INFO	Bryce Kwon	-0/+35
	All three shipped server configs hand cgit the path as PATH_INFO, already decoded, yet every hostile path in the tests went through url= instead.
39 hours	Prove the filter saw the hostile file name	Bryce Kwon	-5/+4
	The name also sits in the breadcrumb and the title, so the test passed with the source filter never run, and the missing marker proved nothing. dump.sh echoes its arguments ahead of the body it upper-cases, which shows the name arrived whole as one argument.
39 hours	Check the line links of a side-by-side diff	Bryce Kwon	-9/+17
	The links have been written through html_attr since b8adfd6, so with the percent-encoding dropped a quote came out as an entity the absence check could not match, and the presence check was met by the file links above the diff. The test now reads the line links themselves, for a name holding a hash and a question mark as well.
39 hours	Look for inline handlers on every main page	Bryce Kwon	-4/+15
	Only the commit page was checked, and only for onchange, though a site policy without unsafe-inline blocks every inline handler on any page.
40 hours	Tie each escaped readme to its own payload	Bryce Kwon	-8/+7
	The escaped script tag alone matched either readme, so the markdown page showing the text readme passed.
40 hours	Compare the small blob the plain page serves	Bryce Kwon	-2/+6
	The test took any page holding the word top, with no status checked. The refusal half lives in t0204, so the fixture now says why its limit is set so low.
40 hours	Read the --output refusal from its own request	Bryce Kwon	-10/+10
	The refusal was read from a page the previous test had left, which --run could skip, and both requests went through the shared page cache. The marker is also named apart from the one the filter test plants, so a failure in one cannot fail the other.
40 hours	Test every scanned key that waits on trust	Bryce Kwon	-23/+79
	Only head-content and logo-link were tried, so logo, clone-url and both module-link forms could have been taken from a repository's own cgitrc unnoticed. A trusted control shows each value would reach the page, and the refused disk readmes are now checked against a file that would show if read.
40 hours	Check the policy sent with repository bytes	Bryce Kwon	-0/+28
	No test asserted the Content-Security-Policy header, though it is all that keeps script in an SVG from running when the plain page serves it under its own type.
40 hours	Test the snapshot slash rule on a real ref	Bryce Kwon	-4/+20
	Every candidate name meets check_refname_format first, which refuses the old payload, so the slash rule never answered it and could go unnoticed. A tag holding a slash reaches it, and a name in revision syntax without a slash now pins the ref name check of its own.
40 hours	Catch an ignored SIGPIPE under any shell	Bryce Kwon	-9/+15
	dash reports a write to a closed pipe as an I/O error and never names a broken pipe, so where sh is dash the test passed with the reset removed. The writer now leaves a marker when it outlives the closed pipe, which it can only do with the signal ignored. That holds under dash, bash and ksh.
40 hours	Prove the login body is cut at the buffer	Bryce Kwon	-5/+16
	The posted body was 22 bytes, so an unclamped read stopped at its end and nothing overflowed, and the test could not fail. The filter now counts what it was handed from a body larger than the buffer.
40 hours	Ask for the working auth pages through cgit_ok	Bryce Kwon	-13/+19
	The unedited copy and the login page were requested through cgit_rc, so a page cut short or an error logged on the way passed. The owner and description checks on the login page could not fail either if the config lost them, so the same config with a filter that lets the visitor in now has to show both.
40 hours	Count the auth unit checks as skipped without Lua	Bryce Kwon	-3/+6
	With no standalone Lua on the path the unit checks were never registered, so they counted as neither run nor skipped, and t0505 passed on its cgit checks alone.
40 hours	Say which earlier tests each hook case needs	Bryce Kwon	-2/+6
40 hours	Push to each hook installed as post-receive	Bryce Kwon	-0/+35
	No hook ran the way git runs it, so the shebang, the executable bit, GIT_DIR, the refs on stdin and the remote: lines a pusher sees were all untested.
40 hours	Check the commit-graph hook with a git too old	Bryce Kwon	-0/+24
	The header says a git too old for the options leaves the graph as it was and the hook stays silent, but every run had a git that could write it.
40 hours	Run the hooks under every POSIX shell present	Bryce Kwon	-24/+45
	Only sh, dash, ksh and bash were tried, so busybox sh ran only where it is /bin/sh, and mksh, yash, posh and zsh's sh mode never ran. Where sh is a link to dash, the same shell ran twice. A shell reached by two names now runs once, and the list is said so a run shows what it covered.
40 hours	Drop cached pages asked for with an escaped url	Bryce Kwon	-2/+20
	README tells a visitor to write a plus in the query form as %2b, and cgit caches such a page under the raw query, but the hook compared that query with the url as it stands. A push to foo+bar.git left its pages under url=foo%2bbar.git/ and r=foo%2Bbar.git cached and stale until their ttl ran out. Decoding in sh would take more than the hook is worth, so a query with a % or a + now counts as stale, which costs another repository's page at most a refill.
40 hours	Check more of the keys the cache hook reads	Bryce Kwon	-0/+16
	No page asked for with r= was cached, no slot held a head that does not parse as cgit's, and the hook never met a cache root that was missing, so ignoring r=, keeping an unreadable slot, or complaining without a cache all passed.
40 hours	Write the auth test configs through cgitrc_repo	Bryce Kwon	-25/+4