From ba0d258f6f0f363303846d4e91d1a6ec4b38f621 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 19:19:45 -1000
Subject: Test a repository url in UTF-8

---
 tests/t0301-security.sh | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

(limited to 'tests/t0301-security.sh')

diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 4df00e7..870d2c5 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -761,4 +761,25 @@ test_expect_success 'a UTF-8 file name is shown as it is and linked percent-enco
 	test_grep ! "href=.[^>]*$name" tmp
 '
 
+# A repository url opens every link to the repository, so one in UTF-8 is
+# shown as it is and linked percent-encoded, whether the request names it
+# encoded or the server hands it over decoded.
+test_expect_success 'a UTF-8 repository url is shown as it is and linked percent-encoded' '
+	url=$(printf "d\303\251p\303\264t") &&
+	encoded=d%C3%A9p%C3%B4t &&
+	cgitrc_site utf8urlrc "repo.url=$url" "repo.path=$PWD/repos/foo/.git" repo.desc=accented &&
+	cgit_ok utf8urlrc "url=" >tmp &&
+	test_grep "<td class=.col-name toplevel-repo.><a href=./$encoded/.>$url</a></td><td class=.col-desc.><a href=./$encoded/.>accented</a>" tmp &&
+	test_grep ! "href=.[^>]*$url" tmp &&
+	cgit_ok utf8urlrc "url=$encoded/" >tmp &&
+	test_grep "<title>$url - Git repository browser</title>" tmp &&
+	test_grep "<div id=.cgit. data-page=.summary. data-repo=.$url.>" tmp &&
+	test_grep "<h1 class=.main.><a href=./.>index</a> : <a href=./$encoded/.>$url</a></h1>" tmp &&
+	test_grep "<a title=.Commit history. href=./$encoded/log/.>log</a>" tmp &&
+	test_grep "<tr class=.branch.><td><a href=./$encoded/log/.>master</a>" tmp &&
+	test_grep ! "href=.[^>]*$url" tmp &&
+	cgit_ok_path utf8urlrc "/$url/" >tmp &&
+	test_grep "<h1 class=.main.><a href=./.>index</a> : <a href=./$encoded/.>$url</a></h1>" tmp
+'
+
 test_done
-- 
cgit 2.12.1