From 34927e81c3a53688e5fede94c084971d5eff41dd Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 16:04:41 -1000 Subject: Check the lone percent sign in the search box For a bare q=% only the status was checked, so a decoder that dropped the sign passed. --- tests/t0301-security.sh | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'tests') diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index dac5c39..c9f16a5 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -417,11 +417,10 @@ test_expect_success 'a commit with an empty author renders everywhere' ' ' test_expect_success 'a percent sign without digits behind it is read as itself' ' - cgit_rc cverc "url=cve/log/&q=%" >tmp && - grep "^Status: 200" tmp && - cgit_rc cverc "url=cve/log/&q=%zz%2" >tmp && - grep "^Status: 200" tmp && - grep "value=.%zz%2." tmp + cgit_ok cverc "url=cve/log/&q=%" >tmp && + test_grep "name=.q. aria-label=.Search. value=.%.>" tmp && + cgit_ok cverc "url=cve/log/&q=%zz%2" >tmp && + test_grep "name=.q. aria-label=.Search. value=.%zz%2.>" tmp ' test_expect_success 'script in a file name is escaped on the diff page' ' -- cgit 2.12.1