From 1a414d88297eec8f2bdf3a0155fbab9f695f1bea Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 16:02:46 -1000
Subject: Test markup in refs, names and messages

No test gave a ref name, a commit or tag message, a note or an ident
any markup, and the one hostile file name never reached an attribute.
html_txt leaves quotes alone, so a name holding both a quote and a
bracket is what tells an attribute written as text.
---
 tests/t0301-security.sh | 54 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

(limited to 'tests')

diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 092e0a9..dac5c39 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -501,4 +501,58 @@ test_expect_success 'repository bytes go out under a policy that loads nothing'
 	test_grep "^Content-Security-Policy: default-src .none.$" tmp
 '
 
+# Ref names, file names, messages and idents are all written by whoever can
+# push, and git takes quotes, an ampersand and angle brackets in each, apart
+# from the brackets in a name. Each has to be escaped for the context it
+# lands in, and html_txt leaves quotes alone, so only a name holding both a
+# quote and a bracket tells an attribute escaped as text.
+test_expect_success 'set up a repository whose names and messages hold markup' '
+	mkrepo repos/mk 1 &&
+	(
+		cd repos/mk &&
+		echo hi >"$(printf "f\047\"<x>&.txt")" &&
+		git add -A &&
+		GIT_AUTHOR_NAME="au & \"q\" '\''s" GIT_COMMITTER_NAME="co & \"q\" '\''s" \
+			git commit -m "subject <x> & \"q\" '\''s" -m "body <x> & \"q\" '\''s" &&
+		git branch "br'\''\"<x>&" &&
+		GIT_COMMITTER_NAME="tagger & \"q\" t" git tag -a -m "tag <x> & \"q\"" "tg'\''\"<x>&" &&
+		git notes add -m "note <x> & \"q\""
+	) &&
+	cgitrc_repo mkrc mk snapshots=tar.gz
+'
+
+test_expect_success 'names and messages holding markup are escaped on every page' '
+	cgit_ok mkrc "url=mk/" >tmp &&
+	test_grep "<option value=.br&#x27;&quot;&lt;x&gt;&amp;.>br.\"&lt;x&gt;&amp;</option>" tmp &&
+	test_grep "<a href=./mk/log/?h=br%27%22%3Cx%3E%26.>br.\"&lt;x&gt;&amp;</a>" tmp &&
+	test_grep "<a href=./mk/tag/?h=tg%27%22%3Cx%3E%26.>tg.\"&lt;x&gt;&amp;</a>" tmp &&
+	test_grep "<a href=./mk/snapshot/mk-tg%27%22%3Cx%3E%26.tar.gz.>mk-tg.\"&lt;x&gt;&amp;.tar.gz</a>" tmp &&
+	test_grep "<td class=.col-author.>au &amp; \"q\" .s</td>" tmp &&
+	test_grep "<td class=.col-author.>tagger &amp; \"q\" t</td>" tmp &&
+	test_grep ! "<x>" tmp &&
+	cgit_ok mkrc "url=mk/log/" >tmp &&
+	test_grep ">subject &lt;x&gt; &amp; \"q\" .s</a>" tmp &&
+	test_grep "<a class=.branch-deco. href=./mk/log/?h=br%27%22%3Cx%3E%26.>br.\"&lt;x&gt;&amp;</a>" tmp &&
+	test_grep ! "<x>" tmp &&
+	cgit_ok mkrc "url=mk/commit/" >tmp &&
+	test_grep "<div class=.commit-subject.>subject &lt;x&gt; &amp; \"q\" .s<" tmp &&
+	test_grep "<div class=.commit-msg.>body &lt;x&gt; &amp; \"q\" .s" tmp &&
+	test_grep "<div class=.notes.>note &lt;x&gt; &amp; \"q\"" tmp &&
+	test_grep "co &amp; \"q\" .s" tmp &&
+	test_grep "<div class=.file. data-path=.f&#x27;&quot;&lt;x&gt;&amp;.txt.>" tmp &&
+	test_grep ! "<x>" tmp &&
+	cgit_ok mkrc "url=mk/commit/&dt=1" >tmp &&
+	test_grep "<tbody class=.file. data-path=.f&#x27;&quot;&lt;x&gt;&amp;.txt.>" tmp &&
+	test_grep ! "<x>" tmp &&
+	cgit_ok mkrc "url=mk/tag/&h=tg%27%22%3Cx%3E%26" >tmp &&
+	test_grep "<div class=.commit-subject.>tag &lt;x&gt; &amp; \"q\"</div>" tmp &&
+	test_grep "tagger &amp; \"q\" t" tmp &&
+	test_grep ! "<x>" tmp &&
+	cgit_ok mkrc "url=mk/atom/" >tmp &&
+	test_grep "<title>subject &lt;x&gt; &amp; \"q\" .s</title>" tmp &&
+	test_grep "<content type=.text.>body &lt;x&gt; &amp; \"q\" .s" tmp &&
+	test_grep "<name>au &amp; \"q\" .s</name>" tmp &&
+	test_grep ! "<x>" tmp
+'
+
 test_done
-- 
cgit 2.12.1