From 7f9ad99b8eb43d2102a383dbbaa8f0c0832bd423 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 06:33:14 -1000 Subject: Answer 404 for any path below the about page The about page served every file beside the readme as a page of its own, through the about filter, and answered 200 for directories and missing files alike. Images it passed through came from the root of the default branch whatever the readme's own directory and ref. A readme on disk exposed its whole directory this way. --- tests/t0301-security.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tests/t0301-security.sh') diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 1a5ee44..ce2b5da 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -445,7 +445,7 @@ test_expect_success 'the dumb transport refuses a path that climbs out' ' test_expect_success 'the about page serves nothing above the readme directory' ' cveq "url=cve/about/../cverc" >tmp && - grep "^Status: 200" tmp && + grep "^Status: 404" tmp && ! grep "virtual-root" tmp && cveq "url=cve/about/" >tmp && grep "readme text" tmp -- cgit