From 60e56e72d13c8e309d9d45f9eb120c62c2db8ae7 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 15:42:03 -1000 Subject: Check the policy sent with repository bytes No test asserted the Content-Security-Policy header, though it is all that keeps script in an SVG from running when the plain page serves it under its own type. --- tests/t0301-security.sh | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 835e922..ff1c241 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -401,4 +401,32 @@ test_expect_success 'shell syntax in a file name reaches a filter as a plain arg ! test -e repos/cve/pwned ' +# An untrusted response hands over repository bytes as they are. An image +# keeps its own type, SVG among them, so script inside one is held back by +# the policy alone. The cache listing prints keys visitors chose. +test_expect_success 'repository bytes go out under a policy that loads nothing' ' + mkrepo repos/svg 1 && + ( + cd repos/svg && + echo "" >x.svg && + git add x.svg && + git commit -m svg + ) && + cgitrc_repo svgrc svg mimetype.svg=image/svg+xml && + cgit_ok svgrc "url=svg/plain/x.svg" >tmp && + test_grep "^Content-Type: image/svg+xml;" tmp && + test_grep "" tmp && + for page in plain/x.svg blob/x.svg + do + cgit_ok svgrc "url=svg/$page" >tmp && + test_grep "^X-Content-Type-Options: nosniff$" tmp && + test_grep "^Content-Security-Policy: default-src .none.$" tmp || return 1 + done && + cgitrc_copy lscacherc && + cgit_ok lscacherc "p=ls_cache" >tmp && + test_grep "^Content-Type: text/plain;" tmp && + test_grep "^X-Content-Type-Options: nosniff$" tmp && + test_grep "^Content-Security-Policy: default-src .none.$" tmp +' + test_done -- cgit 2.12.1