From 4a2ed95682db983ac8f4198796cb46aaf1f362b8 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 16:26:53 -1000 Subject: Test a HEAD aimed outside its repository The defbranch check had a test while its twin for a crafted HEAD, which the index reads the same way to date a repository, had none. --- tests/t0303-robustness.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'tests') diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh index 7e79b87..d511ac1 100755 --- a/tests/t0303-robustness.sh +++ b/tests/t0303-robustness.sh @@ -870,4 +870,22 @@ test_expect_success 'a scanned defbranch cannot name a path outside the reposito ! grep "data-ut=.946" tmp ' +# HEAD is a file the repository's owner writes as well, and the index stats +# the branch it names to date the repository. +test_expect_success 'a crafted HEAD cannot date a repository from outside it' ' + mkdir -p aimed && + touch -t 200001010000 aimed/file && + git init -q --bare headscan/h.git && + echo "ref: refs/heads/../../../../aimed/file" >headscan/h.git/HEAD && + { + echo "virtual-root=/" && + echo "cache-size=0" && + echo "scan-path=$PWD/headscan" + } >headrc && + cgit_rc headrc "url=" >tmp && + test_grep "^Status: 200" tmp && + test_grep ">h.git" tmp && + test_grep ! "data-ut=.946" tmp +' + test_done -- cgit 2.12.1