From 81c332fc885bbcb2624edde4dc0226e9fd8f706f Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 17 Oct 2026 17:09:13 -1000 Subject: Serve only the files a dumb clone asks for The object path check let any run of safe characters through, so a spelling such as info//alternates or info/./alternates reached the alternates file the exact name was refused for. Only a loose object, a pack with its index and info/http-alternates are served now, and any other path is not found. --- tests/t0303-robustness.sh | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'tests/t0303-robustness.sh') diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh index cbb4cdc..005c6cd 100755 --- a/tests/t0303-robustness.sh +++ b/tests/t0303-robustness.sh @@ -592,9 +592,13 @@ test_expect_success 'the dumb transport sends a file with its size' ' test_expect_success 'the dumb transport withholds the alternates file' ' mkdir -p repos/rob/.git/objects/info && echo "$PWD/repos/foo/.git/objects" >repos/rob/.git/objects/info/alternates && - robq "url=rob/objects/info/alternates" >tmp && - grep "^Status: 404" tmp && - ! grep "repos/foo" tmp && + for path in info/alternates info//alternates info/./alternates ./info/alternates \ + info/Alternates /info/alternates + do + robq "url=rob/objects/$path" >tmp && + grep "^Status: 404" tmp && + ! grep "repos/foo" tmp || return 1 + done && rm repos/rob/.git/objects/info/alternates && robq "url=rob/objects/info/packs" >tmp && grep "^Status: 200" tmp -- cgit