From 523c7cfea8215184752319089cde9fd959ad5310 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 16:20:51 -1000 Subject: Test the download names a request chooses The plain page's header was the only one fed a newline. A snapshot asked for with h= keeps the name it was requested under, and a blob fetched by id takes any path, so both put visitor bytes into Content-Disposition. --- tests/t0301-security.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 95a31d5..566b852 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -640,4 +640,22 @@ test_expect_success 'request values echoed into a page are escaped' ' ) ' +# With h= or id= given, a snapshot is named as requested rather than worked +# back to a ref, and a blob fetched by id takes whatever path the request +# names, so both reach the Content-Disposition header straight from the +# visitor. +test_expect_success 'a requested download name cannot split the headers' ' + crlf=crlf%0d%0aX-Injected:%201 && + cgit_ok mkrc "url=mk/snapshot/$crlf.tar.gz&h=master" >tmp && + sed -n "1,/^\$/p" tmp >headers && + test_grep "^Content-Type: application/gzip$" headers && + test_grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.tar.gz.$" headers && + test_grep ! "^X-Injected" headers && + blob=$(git -C repos/mk rev-parse HEAD:file-1) && + cgit_ok mkrc "url=mk/blob/&id=$blob&path=$crlf" >tmp && + sed -n "1,/^\$/p" tmp >headers && + test_grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.$" headers && + test_grep ! "^X-Injected" headers +' + test_done -- cgit 2.12.1