From 21952ba79a3a143f07f7041898066f369b2519f9 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 14:07:00 -1000 Subject: Check the auth files that are missing or broken Only a missing users file and a missing repos file were tried. A missing groups file denies today, but a change returning nil there would have made every protected repository public unnoticed. The repos file's log line and a users file with no line that parses, which has to turn a login down without spending crypt, went unchecked too. --- tests/extensions/test-auth.lua | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'tests/extensions/test-auth.lua') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 6bd588d..852a5d9 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -192,12 +192,21 @@ if variant == "file" then -- public one, so every page is refused, the index too, which cgit asks -- about with an empty repository name. h.redirect_file("/etc/cgit-auth/repos", directory .. "/auth-repos-missing") + h.reset() local refused = repo_userset("unlisted") h.check("a missing repos file refuses every repository", refused ~= nil and next(refused) == nil) + h.contains("and says so in the error log", h.error_log(), "[cgit] Unable to read the auth repos file: ") local index = repo_userset("") h.check("and the index as well", index ~= nil and next(index) == nil) h.redirect_file("/etc/cgit-auth/repos", directory .. "/auth-repos") + -- Without the groups file nobody is a member, which has to deny rather + -- than make the repository public. + h.redirect_file("/etc/cgit-auth/groups", directory .. "/auth-groups-missing") + local memberless = repo_userset("secret-repo") + h.check("a missing groups file leaves a protected repository with nobody let in", + memberless ~= nil and next(memberless) == nil) + h.redirect_file("/etc/cgit-auth/groups", directory .. "/auth-groups") end -- The url and cookie helpers. @@ -389,6 +398,11 @@ h.equals("a session signed without its binding does not verify", validate_value("username", unbound, account_hash), nil) h.equals("a memberless repository denies even a valid session", visit("empty-repo", session), 0) +if variant == "file" then + h.redirect_file("/etc/cgit-auth/groups", directory .. "/auth-groups-missing") + h.equals("as does one whose groups file is missing", visit("secret-repo", session), 0) + h.redirect_file("/etc/cgit-auth/groups", directory .. "/auth-groups") +end local outsider = secure_value("username", "carol", now + 3600, stored_hash) h.equals("a signed session for an outsider is turned away", visit("secret-repo", outsider), 0) @@ -519,6 +533,13 @@ if variant == "file" then crypt_settings = {} login("nobody", "x", way_back) h.equals("with no accounts at all nothing is spent", #crypt_settings, 0) + write_file(directory .. "/auth-users-unparsable", "not a parsable line\nnor this one\n") + h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users-unparsable") + crypt_settings = {} + out = login("Alice", password, way_back) + h.contains("a users file with no line that parses turns a login down", out, + "Location: /repo/?login=failed\n") + h.equals("and spends nothing either", #crypt_settings, 0) h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users") end -- cgit 2.12.1