From 1f7b13f933aa523c89ebb16b7feaf21ce3237beb Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 25 Jul 2026 20:36:43 -1000 Subject: Swap the browser markdown renderer for a filter The readme is now escaped plain text unless about-filter points at the new about-render.lua, which renders markdown, man pages and plain text server-side. The enable-markdown setting goes away with the renderer. --- tests/t0200-security.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'tests') diff --git a/tests/t0200-security.sh b/tests/t0200-security.sh index 83cdbfd..425708e 100644 --- a/tests/t0200-security.sh +++ b/tests/t0200-security.sh @@ -73,7 +73,7 @@ test_expect_success 'a small blob is still served' ' ' # --- Readme rendering escapes untrusted repository content ------------------ -test_expect_success 'markdown readme is escaped and marked for the client' ' +test_expect_success 'markdown readme without a filter is escaped as plain text' ' { echo "virtual-root=/" && echo "cache-size=0" && @@ -82,7 +82,7 @@ test_expect_success 'markdown readme is escaped and marked for the client' ' echo "repo.readme=master:README.md" } >secmdrc && CGIT_CONFIG="$PWD/secmdrc" QUERY_STRING="url=md/about/" cgit >tmp && - grep "data-markdown" tmp && + grep "pre class=.plaintext." tmp && grep "<script>" tmp && ! grep "" tmp ' -- cgit 2.12.1