From c791d03fe10c23994b2d41966484582eaa548c5c Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Tue, 29 Sep 2026 19:52:55 -1000 Subject: Answer 404 for any path below the about page The about page served every file beside the readme as a page of its own, through the about filter, and answered 200 for directories and missing files alike. Images it passed through came from the root of the default branch whatever the readme's own directory and ref. A readme on disk exposed its whole directory this way. --- tests/t0301-security.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tests/t0301-security.sh') diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 1a5ee44..ce2b5da 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -445,7 +445,7 @@ test_expect_success 'the dumb transport refuses a path that climbs out' ' test_expect_success 'the about page serves nothing above the readme directory' ' cveq "url=cve/about/../cverc" >tmp && - grep "^Status: 200" tmp && + grep "^Status: 404" tmp && ! grep "virtual-root" tmp && cveq "url=cve/about/" >tmp && grep "readme text" tmp -- cgit 2.12.1