From 1dd7ddaf5c9833aa7c01c71a73af9fac68012618 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 12:34:23 -1000 Subject: Test the PDF exception to the unsafe plain types --- tests/t0105-plain.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/tests/t0105-plain.sh b/tests/t0105-plain.sh index b9c7a78..63ab661 100755 --- a/tests/t0105-plain.sh +++ b/tests/t0105-plain.sh @@ -105,6 +105,24 @@ test_expect_success 'only text and xml types carry a charset' ' sed "/^$/q" tmp | grep "^Content-Type: image/svg+xml; charset=UTF-8$" ' +# Without html serving a text or application type gives way to the sniffed +# one, except PDF, which a browser shows without running the site's code. +test_expect_success 'only PDF keeps an application type without html serving' ' + test_create_repo repos/types && + ( + cd repos/types && + printf "%%PDF-1.4" >doc.pdf && + printf "alert(1)" >run.js && + git add doc.pdf run.js && + git commit -m types + ) && + cgitrc_repo pdfrc types mimetype.pdf=application/pdf mimetype.js=application/javascript && + cgit_ok pdfrc "url=types/plain/doc.pdf" >tmp && + sed "/^$/q" tmp | grep "^Content-Type: application/pdf$" && + cgit_ok pdfrc "url=types/plain/run.js" >tmp && + sed "/^$/q" tmp | grep "^Content-Type: text/plain; charset=UTF-8$" +' + # A tree can carry two entries of one name, which only a repository with # fsck off accepts, and the plain view answers the first alone. test_expect_success 'plain answers once for duplicate tree entries' ' -- cgit 2.12.1