From 47a5c008d220fc052590185c5606aaae4728f3b0 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 16:06:48 -1000
Subject: Test request values a page echoes back

Only %zz%2 had been sent, so nothing showed that markup in the query,
the hidden inputs a form carries, the errors naming a refused value or
the Host header is escaped on its way back.
---
 tests/t0301-security.sh | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

(limited to 'tests')

diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index c9f16a5..40de049 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -554,4 +554,40 @@ test_expect_success 'names and messages holding markup are escaped on every page
 	test_grep ! "<x>" tmp
 '
 
+# A page echoes the request in the search box, in the hidden inputs that
+# carry a form's state, in the error naming what it refused and, from the
+# Host header, in every absolute link.
+test_expect_success 'request values echoed into a page are escaped' '
+	payload=%27%3E%3Cs%3E &&
+	escaped="&#x27;&gt;&lt;s&gt;" &&
+	cgit_ok mkrc "url=mk/log/&q=$payload&qt=$payload&id=$payload" >tmp &&
+	test_grep "name=.q. aria-label=.Search. value=.$escaped.>" tmp &&
+	for name in q qt id
+	do
+		test_grep "<input type=.hidden. name=.$name. value=.$escaped.>" tmp || return 1
+	done &&
+	test_grep ! "<s>" tmp &&
+	cgit_ok mkrc "url=mk/log/&h=br%27%22%3Cx%3E%26" >tmp &&
+	test_grep "<input type=.hidden. name=.h. value=.br&#x27;&quot;&lt;x&gt;&amp;.>" tmp &&
+	test_grep ! "<x>" tmp &&
+	cgit_rc mkrc "url=mk/log/&h=%3Cb%3E" >tmp &&
+	test_grep "<div class=.error.>Invalid branch: &lt;b&gt;</div>" tmp &&
+	cgit_rc mkrc "url=mk/snapshot/%3Cb%3E.zzz" >tmp &&
+	test_grep "<div class=.error.>Unsupported snapshot format: &lt;b&gt;.zzz</div>" tmp &&
+	cgit_rc mkrc "url=mk/blob/%3Cb%3E" >tmp &&
+	test_grep "<div class=.error.>Path not found: &lt;b&gt;</div>" tmp &&
+	test_grep ! "<b>" tmp &&
+	(
+		HTTP_HOST="h'\''\"<x>" &&
+		export HTTP_HOST &&
+		cgit_ok mkrc "url=mk/" >tmp &&
+		test_grep "<link rel=.alternate. title=.Atom feed. href=.http://h&#x27;&quot;&lt;x&gt;/mk/atom/?h=master." tmp &&
+		test_grep ! "<x>" tmp &&
+		cgit_ok mkrc "url=mk/atom/" >tmp &&
+		test_grep "<id>http://h..&lt;x&gt;/mk/atom/</id>" tmp &&
+		test_grep "<link rel=.alternate. type=.text/html. href=.http://h&#x27;&quot;&lt;x&gt;/mk/./>" tmp &&
+		test_grep ! "<x>" tmp
+	)
+'
+
 test_done
-- 
cgit 2.12.1