From 5703446c1225212478731b884a215cac77155c59 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 19:29:15 -1000
Subject: Percent-encode a clone url in its href
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An href carried git://example.org/dépôt.git as it was, and the space
of "with space" too, neither of which a url may hold. html_url_path
would also encode the plus of git+ssh, which breaks the scheme, and the
percent of an escape the url was written with, so a whole url gets a
helper that encodes only the bytes RFC 3986 allows nowhere.
---
 tests/t0102-summary.sh | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

(limited to 'tests')

diff --git a/tests/t0102-summary.sh b/tests/t0102-summary.sh
index 632698c..a7c2c42 100755
--- a/tests/t0102-summary.sh
+++ b/tests/t0102-summary.sh
@@ -76,7 +76,7 @@ test_expect_success 'a space in the repository url stays inside one clone url' '
 	cgit_ok_url "with+space" >tmp &&
 	test_grep "clone-url.><a rel=.vcs-git. title=.with space Git repository. href=./with%20space/.>git://example.org/with space.git</a>" tmp &&
 	test $(grep -c "class=.clone-url." tmp) = 1 &&
-	test_grep "<link rel=.vcs-git. href=.git://example.org/with.*space\.git. title=.with space Git repository.>" tmp &&
+	test_grep "<link rel=.vcs-git. href=.git://example.org/with%20space\.git. title=.with space Git repository.>" tmp &&
 	test $(grep -c "<link rel=.vcs-git." tmp) = 1 &&
 	cgitrc_repo spacerc "with space" "clone-prefix=https://a git://b" &&
 	cgit_ok spacerc "url=with+space" >tmp &&
@@ -85,6 +85,40 @@ test_expect_success 'a space in the repository url stays inside one clone url' '
 	test $(grep -c "class=.clone-url." tmp) = 2
 '
 
+# A clone url is shown as written, but linked with each byte a url cannot
+# carry percent-encoded. Its scheme, its delimiters and any escape it was
+# written with are left as they are.
+test_expect_success 'a clone url is linked percent-encoded' '
+	url=$(printf "d\303\251p\303\264t") &&
+	encoded=d%C3%A9p%C3%B4t &&
+	cgitrc_repo encrc "$url" "repo.path=$PWD/repos/foo/.git" \
+		"repo.clone-url=git+ssh://example.org/my%20repos/\$CGIT_REPO_URL.git https://example.org/\$CGIT_REPO_URL" &&
+	cgit_ok encrc "url=$encoded" >tmp &&
+	test_grep "<link rel=.vcs-git. href=.git+ssh://example.org/my%20repos/$encoded\.git. title=.$url Git repository.>" tmp &&
+	test_grep "<link rel=.vcs-git. href=.https://example.org/$encoded. title=.$url Git repository.>" tmp &&
+	test_grep "title=.$url Git repository. href=.https://example.org/$encoded.>git+ssh://example.org/my%20repos/$url\.git</a>" tmp &&
+	test_grep "title=.$url Git repository. href=.https://example.org/$encoded.>https://example.org/$url</a>" tmp &&
+	test_grep ! "href=.[^ >]*$url" tmp &&
+	cgit_ok spacerc "url=with+space" >tmp &&
+	test_grep "<link rel=.vcs-git. href=.https://a/with%20space. title=.with space Git repository.>" tmp &&
+	test_grep "<link rel=.vcs-git. href=.git://b/with%20space. title=.with space Git repository.>" tmp &&
+	test_grep "href=.https://a/with%20space.>git://b/with space</a>" tmp
+'
+
+# The macros read the request as well, so a clone url built from the Host
+# header has to stay inside the attribute it is linked from.
+test_expect_success 'a clone url from the request stays inside its attribute' '
+	cgitrc_repo hostrc foo "repo.clone-url=https://\$HTTP_HOST/\$CGIT_REPO_URL" &&
+	(
+		HTTP_HOST="h'\''\"<x>" &&
+		export HTTP_HOST &&
+		cgit_ok hostrc "url=foo" >tmp
+	) &&
+	test_grep "<link rel=.vcs-git. href=.https://h&#x27;%22%3Cx%3E/foo. title=.foo Git repository.>" tmp &&
+	test_grep "href=.https://h&#x27;%22%3Cx%3E/foo.>https://h..&lt;x&gt;/foo</a>" tmp &&
+	test_grep ! "<x>" tmp
+'
+
 # A repository can turn the global clone-url off with an empty one of its own.
 # Neither its summary nor the page an empty repository gets then draws a Clone
 # heading over no rows.
-- 
cgit 2.12.1