From 9532ef18c1696e588baf0bfa112fc674fdc3cce8 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 15:56:59 -1000 Subject: Prove the filter saw the hostile file name The name also sits in the breadcrumb and the title, so the test passed with the source filter never run, and the missing marker proved nothing. dump.sh echoes its arguments ahead of the body it upper-cases, which shows the name arrived whole as one argument. --- tests/t0301-security.sh | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 8cb1b5b..0ac6cb0 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -416,11 +416,10 @@ test_expect_success 'script in a file name is escaped on the diff page' ' ' test_expect_success 'shell syntax in a file name reaches a filter as a plain argument' ' - cgit_rc cverc "url=cve/tree/%24(touch%20pwned).c" >tmp && - grep "^Status: 200" tmp && - grep "pwned).c" tmp && - ! test -e pwned && - ! test -e repos/cve/pwned + cgit_ok cverc "url=cve/tree/%24(touch%20pwned).c" >tmp && + test_grep -F "\$(touch pwned).c X" tmp && + test_path_is_missing pwned && + test_path_is_missing repos/cve/pwned ' # An untrusted response hands over repository bytes as they are. An image -- cgit 2.12.1