From e2f98ba03181ecb1f7dc387eaf41e8e9d96845e0 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 15:54:41 -1000
Subject: Check the line links of a side-by-side diff

The links have been written through html_attr since b8adfd6, so with
the percent-encoding dropped a quote came out as an entity the absence
check could not match, and the presence check was met by the file
links above the diff. The test now reads the line links themselves,
for a name holding a hash and a question mark as well.
---
 tests/t0301-security.sh | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

(limited to 'tests/t0301-security.sh')

diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 64129b6..8cb1b5b 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -129,23 +129,31 @@ test_expect_success 'tree groups directories before files' '
 
 # A file name is repository content and may hold a quote, which would break
 # out of the href attribute on the line number links of a side-by-side diff,
-# so the path is percent-encoded on its way into them.
-test_expect_success 'ssdiff percent-encodes a quoted file path' '
+# or a hash or question mark, which the attribute escaping leaves alone and
+# a browser would read as the end of the path. So the path is percent-encoded
+# on its way into them.
+test_expect_success 'ssdiff percent-encodes the file path in its line links' '
 	mkrepo repos/xss 1 &&
-	name=$(printf "x\047y.txt") &&
+	quoted=$(printf "x\047y.txt") &&
 	(
 		cd repos/xss &&
-		printf "a\nb\n" >"$name" &&
+		printf "a\nb\n" >"$quoted" &&
+		printf "a\nb\n" >"p#q?.txt" &&
 		git add -A &&
 		git commit -m add &&
-		printf "a\nc\n" >"$name" &&
+		printf "a\nc\n" >"$quoted" &&
+		printf "a\nc\n" >"p#q?.txt" &&
 		git commit -am change
 	) &&
 	cgitrc_repo xssrc xss &&
-	sha=$(git -C repos/xss rev-parse HEAD) &&
-	cgit_rc xssrc "url=xss/diff/&id=$sha&ss=1" >tmp &&
-	grep "tree/x%27y.txt" tmp &&
-	! grep "href=.[^>]*x.y.txt.[^>]*>" tmp
+	old=$(git -C repos/xss rev-parse HEAD~1) &&
+	new=$(git -C repos/xss rev-parse HEAD) &&
+	cgit_ok xssrc "url=xss/diff/&id=$new&ss=1" >tmp &&
+	for path in x%27y.txt p%23q%3F.txt
+	do
+		test_grep "<td class=.lineno.><a href=./xss/tree/$path?id=$old#n2.>2</a></td>" tmp &&
+		test_grep "<td class=.lineno.><a href=./xss/tree/$path?id=$new#n2.>2</a></td>" tmp || return 1
+	done
 '
 
 # git itself will write a commit with an empty message, so the log and the
-- 
cgit 2.12.1