From 6263f1d2e05b73d0358779b7b8d99c8251480386 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sun, 19 Jul 2026 15:34:16 -1000 Subject: Submit option forms without inline handlers --- tests/t0200-security.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'tests') diff --git a/tests/t0200-security.sh b/tests/t0200-security.sh index 221b56b..afce715 100644 --- a/tests/t0200-security.sh +++ b/tests/t0200-security.sh @@ -100,6 +100,16 @@ test_expect_success 'non-markdown readme without a filter is escaped' ' ! grep "" tmp ' +# --- Auto-submitting selects carry no inline handlers ------------------------ +# A Content-Security-Policy without unsafe-inline blocks inline onchange +# handlers, so the forms mark their selects and cgit.js wires them up. +test_expect_success 'diff option selects use the autosubmit marker' ' + sha=$(git -C repos/foo rev-parse HEAD) && + cgit_query "url=foo/commit&id=$sha" >tmp && + grep "data-autosubmit" tmp && + ! grep "onchange" tmp +' + # --- Fork feature: directories are grouped before files in the tree --------- test_expect_success 'tree groups directories before files' ' secq "url=sec/tree/" >tmp && -- cgit v2.8.0