From 960453245fc66bcfadc685f358f2f3220d879591 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 15:50:51 -1000 Subject: Tie each escaped readme to its own payload The escaped script tag alone matched either readme, so the markdown page showing the text readme passed. --- tests/t0301-security.sh | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index a9dab52..eeff041 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -67,17 +67,16 @@ test_expect_success 'markdown readme without a filter is escaped as plain text' echo "repo.path=$PWD/repos/sec/.git" && echo "repo.readme=master:readme.txt" } >secreadmerc && - cgit_rc secreadmerc "url=md/about/" >tmp && - grep "pre class=.plaintext." tmp && - grep "<script>" tmp && - ! grep "" tmp + cgit_ok secreadmerc "url=md/about/" >tmp && + test_grep "pre class=.plaintext.># Title$" tmp && + test_grep "^<script>alert(1)</script>$" tmp && + test_grep ! "" tmp ' test_expect_success 'non-markdown readme without a filter is escaped as plain text' ' - cgit_rc secreadmerc "url=txt/about/" >tmp && - grep "pre class=.plaintext." tmp && - grep "<script>" tmp && - ! grep "" tmp + cgit_ok secreadmerc "url=txt/about/" >tmp && + test_grep "pre class=.plaintext.><script>alert(2)</script>$" tmp && + test_grep ! "" tmp ' # root-readme is the site's own file rather than repository content, so it -- cgit 2.12.1