From e4263b952faba40be27f2f5118dc99bb962750d0 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Mon, 24 Aug 2026 16:11:31 -1000
Subject: Resolve submodule links from `.gitmodules`

---
 tests/t0200-security.sh | 41 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

(limited to 'tests/t0200-security.sh')

diff --git a/tests/t0200-security.sh b/tests/t0200-security.sh
index f475301..8fce5f4 100755
--- a/tests/t0200-security.sh
+++ b/tests/t0200-security.sh
@@ -277,7 +277,7 @@ test_expect_success 'a surplus conversion is shown literally, not filled' '
 	grep "href=./m/submod/[0-9a-f]*/%s/%s/" tmp
 '
 
-test_expect_success 'a well-formed module-link still takes path and sha1' '
+test_expect_success 'a well-formed module-link still takes name and sha1' '
 	{
 		echo "virtual-root=/" &&
 		echo "cache-size=0" &&
@@ -316,4 +316,43 @@ test_expect_success 'a doubled percent in a module-link renders as one' '
 	grep "href=./m/submod/%/$sub." tmp
 '
 
+# The .gitmodules file is commit-controlled content, so a derived link may
+# carry any scheme and any byte an author can commit. Only http and https
+# may reach an href, and everything lands attribute-escaped.
+test_expect_success 'set up a hostile .gitmodules' '
+	(
+		cd repos/modlink &&
+		sub=$(git rev-parse HEAD) &&
+		git update-index --add --cacheinfo 160000,$sub,quoted &&
+		cat >.gitmodules <<-EOF &&
+		[submodule "submod"]
+			path = submod
+			url = javascript:alert(1)
+		[submodule "quoted"]
+			path = quoted
+			url = https://example.com/x'\''><script>alert(1)</script>
+		EOF
+		git add .gitmodules &&
+		git commit -m hostile
+	) &&
+	{
+		echo "virtual-root=/" &&
+		echo "cache-size=0" &&
+		echo "enable-gitmodules-links=1" &&
+		echo "repo.url=modlink" &&
+		echo "repo.path=$PWD/repos/modlink/.git"
+	} >modlinkgmrc
+'
+
+test_expect_success 'a javascript url never reaches an href' '
+	CGIT_CONFIG="$PWD/modlinkgmrc" QUERY_STRING="url=modlink/tree/" cgit >tmp &&
+	! grep "href=.javascript:" tmp &&
+	grep "class=.ls-mod. title=.javascript:alert(1).>submod</span>" tmp
+'
+
+test_expect_success 'a quote in a web url cannot break out of the href' '
+	! grep "<script>alert" tmp &&
+	grep "href=.https://example.com/x&#x27;&gt;&lt;script&gt;" tmp
+'
+
 test_done
-- 
cgit v2.8.0