From c3108847090ed1e7a71a674b55320d86a9a4117d Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 16:17:25 -1000 Subject: Test the dumb transport allowlist in one table The allowlist was tested in two places, and the 404 alone did not show the transport was live behind the auth filter, since a page that does not exist answers the same. A loose object and HEAD now have to come through, and the planted alternates file is removed even when the test fails, where it used to leave rob borrowing foo's objects. --- tests/t0301-security.sh | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) (limited to 'tests/t0301-security.sh') diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 9b887d4..555eb89 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -415,13 +415,24 @@ test_expect_success 'a posted length past any buffer is clamped' ' test $(cat received) = 10 ' -test_expect_success 'the dumb transport refuses a path that climbs out' ' - cgit_rc cverc "url=cve/objects/../config" >tmp && - grep "^Status: 404" tmp && - ! grep "repositoryformatversion" tmp && - cgit_rc cverc "url=cve/objects/info/../../config" >tmp && - grep "^Status: 404" tmp && - ! grep "repositoryformatversion" tmp +# The dumb transport serves a file below objects only by the shape a client +# asks for, so no spelling of a path climbs out or reaches the alternates +# file, which names object directories by their path on the server. +test_expect_success 'the dumb transport serves nothing but objects and packs' ' + echo "$PWD/repos/foo/.git/objects" >repos/cve/.git/objects/info/alternates && + test_when_finished "rm repos/cve/.git/objects/info/alternates" && + for path in ../config info/../../config info/alternates info//alternates \ + info/./alternates ./info/alternates info/Alternates /info/alternates + do + cgit_rc cverc "url=cve/objects/$path" >tmp && + test_grep "^Status: 404" tmp && + test_grep ! -e repositoryformatversion -e repos/foo tmp || return 1 + done && + cgit_ok cverc "url=cve/HEAD" >tmp && + test_grep "^ref: refs/heads/master$" tmp && + blob=$(git -C repos/cve rev-parse HEAD:file-1) && + cgit_ok cverc "url=cve/objects/$(test_oid_to_path $blob)" >tmp && + test_grep "^Content-Type: application/octet-stream$" tmp ' test_expect_success 'the about page serves nothing above the readme directory' ' -- cgit 2.12.1