From de6e91482e19c6b2aaeb0ab20e92425a71036b81 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 17 Oct 2026 17:09:15 -1000 Subject: Keep every control byte out of a header value A quoted header value escaped only the quote, the backslash, CR and LF. A web server refuses a response whose header holds any other control byte, so a file named with one could not be downloaded at all. --- tests/t0105-plain.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'tests/t0105-plain.sh') diff --git a/tests/t0105-plain.sh b/tests/t0105-plain.sh index 2e5513f..4615dc5 100755 --- a/tests/t0105-plain.sh +++ b/tests/t0105-plain.sh @@ -96,4 +96,18 @@ test_expect_success 'plain answers once for duplicate tree entries' ' grep "^Content-Type: image/png" tmp ' +# A header line cannot carry a control byte, and a web server refuses the +# whole response over one, so a file name holding one is sent with a stand-in. +test_expect_success 'a control character in a file name stays out of the headers' ' + ( + cd repos/dup && + blob=$(printf x | git hash-object -w --stdin) && + top=$(printf "100644 blob %s\\tctl\\001name.txt\\n" $blob | git mktree) && + c=$(echo ctl | git commit-tree $top) && + git update-ref refs/heads/ctl $c + ) && + CGIT_CONFIG="$PWD/duprc" QUERY_STRING="url=dup/plain/ctl%01name.txt&h=ctl" cgit >tmp && + grep "^Content-Disposition: inline; filename=.ctl?name.txt.$" tmp +' + test_done -- cgit