From 6a45d8c7e9f66d04cf4916264da135def5c0549d Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 19:31:51 -1000 Subject: Add filename* for a download name past ASCII MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The plain, snapshot and blob pages sent a name such as café.txt raw in filename, which a client may read as ISO-8859-1. RFC 6266 has such a name sent again as filename*, percent-encoded in UTF-8, for a client that knows the form, with filename first for one that does not. The extended form carries UTF-8 alone, so a name that is not valid UTF-8 keeps the plain filename by itself. --- tests/t0110-snapshot.sh | 14 ++++++++++++++ tests/t0301-security.sh | 27 ++++++++++++++++++++++++--- 2 files changed, 38 insertions(+), 3 deletions(-) (limited to 'tests') diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.sh index ded694d..0ada26d 100755 --- a/tests/t0110-snapshot.sh +++ b/tests/t0110-snapshot.sh @@ -430,4 +430,18 @@ test_expect_success 'a signature past max-blob-size is refused' ' cgit_ok sigrc "url=signed/snapshot/signed-one.tar.gz.asc" >tmp ' +# A tag named in UTF-8 gives a snapshot name past ASCII, which is sent as it +# is in filename and percent-encoded in filename*. +test_expect_success 'a snapshot name in UTF-8 is also sent as filename*' ' + mkrepo repos/accent 1 && + tag=$(printf "caf\303\251") && + git -C repos/accent tag "$tag" && + cgitrc_repo accentrc accent snapshots=tar && + cgit_ok accentrc "url=accent/refs/tags" >tmp && + test_grep "accent-$tag.tar" tmp && + cgit_ok accentrc "url=accent/snapshot/accent-caf%C3%A9.tar" >tmp && + sed "/^$/q" tmp >headers && + test_grep "^Content-Disposition: inline; filename=.accent-$tag.tar.; filename\*=UTF-8..accent-caf%C3%A9.tar$" headers +' + test_done diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 6ea8d45..7f0bb59 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -666,6 +666,26 @@ test_expect_success 'a requested download name cannot split the headers' ' test_grep ! "^X-Injected" headers ' +# A download name past ASCII is sent again as filename*, percent-encoded in +# UTF-8, which a client that knows the form reads in place of the plain one. +# A quote, a backslash and a control byte keep their escapes in the plain +# form and are percent-encoded in the other. A name that is not valid UTF-8 +# cannot be given as UTF-8, so it keeps the plain form alone. +test_expect_success 'a download name past ASCII is also sent as filename*' ' + blob=$(git -C repos/mk rev-parse HEAD:file-1) && + cgit_ok mkrc "url=mk/blob/&id=$blob&path=%22caf%C3%A9%5C%0D%0AX-Injected:%201%01" >tmp && + sed -n "1,/^\$/p" tmp >headers && + test_grep ! "^X-Injected" headers && + grep "^Content-Disposition:" headers >actual && + printf "Content-Disposition: inline; filename=\042\134\042caf\303\251\134\134\134r\134nX-Injected: 1?\042; filename*=UTF-8\047\047%%22caf%%C3%%A9%%5C%%0D%%0AX-Injected%%3A%%201%%01\n" >expect && + test_cmp expect actual && + cgit_ok mkrc "url=mk/blob/&id=$blob&path=bad%FF" >tmp && + sed -n "1,/^\$/p" tmp >headers && + grep "^Content-Disposition:" headers >actual && + printf "Content-Disposition: inline; filename=\042bad\377\042\n" >expect && + test_cmp expect actual +' + # The about page of a repository without a readme sends the visitor on to # the summary with the query string as it arrived, which a server hands over # undecoded, so a byte no header line may carry is encoded on the way out. @@ -712,8 +732,9 @@ test_expect_success 'a file name of stray bytes is linked percent-encoded' ' # A name in UTF-8 is the common case of the same. It goes through the index # as well, so the tree holds the composed form whatever a filesystem makes -# of the name, and each page shows it as it is, the download name included, -# and links it percent-encoded. +# of the name, and each page shows it as it is and links it percent-encoded. +# The download name is sent as it is in filename and percent-encoded in +# filename*. test_expect_success 'a UTF-8 file name is shown as it is and linked percent-encoded' ' mkrepo repos/utf8 1 && name=$(printf "caf\303\251.txt") && @@ -738,7 +759,7 @@ test_expect_success 'a UTF-8 file name is shown as it is and linked percent-enco test_grep "au revoir$" tmp && test_grep ! "href=.[^>]*$name" tmp && cgit_ok utf8rc "url=utf8/plain/$encoded" >tmp && - test_grep "^Content-Disposition: inline; filename=.$name.$" tmp && + test_grep "^Content-Disposition: inline; filename=.$name.; filename\*=UTF-8..$encoded$" tmp && strip_headers body && echo "au revoir" >expect && test_cmp expect body && -- cgit 2.12.1