From e6f4c2ad43095eb184ee0665eedea99ed9bed729 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 31 Oct 2026 13:14:19 -0700 Subject: Refuse pathspec magic on the stats page --- tests/t0112-stats.sh | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'tests/t0112-stats.sh') diff --git a/tests/t0112-stats.sh b/tests/t0112-stats.sh index 7e1fcc5..3728412 100755 --- a/tests/t0112-stats.sh +++ b/tests/t0112-stats.sh @@ -124,4 +124,13 @@ test_expect_success 'the window opens at midnight on its first day' ' ! grep ">Too Early<" tmp ' +# A path starting with a colon would reach git as pathspec magic, which the +# log, the feed and the patch page refuse as well. +test_expect_success 'a path with pathspec magic is refused' ' + statq "url=stat/stats/%3A%28icase%29FILE-1" >tmp && + grep "^Status: 400" tmp && + statq "url=stat/stats/file-1" >tmp && + grep "^Status: 200" tmp +' + test_done -- cgit