From 6e9dec760da0b996a914cd6a1ba41540e4bbb6dd Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 16:08:56 -1000
Subject: Try every risky scheme in a .gitmodules url

Only a lowercase javascript url was tried, so a denylist of that one
spelling would have passed. The quote test also read the page the test
before it had left.
---
 tests/t0301-security.sh | 41 +++++++++++++++++++++++++++++------------
 1 file changed, 29 insertions(+), 12 deletions(-)

(limited to 'tests')

diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 40de049..4745c44 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -298,16 +298,32 @@ test_expect_success 'a clone endpoint with http clone off answers the same way'
 
 # The .gitmodules file is commit-controlled content, so a derived link may
 # carry any scheme and any byte an author can commit. Only http and https
-# may reach an href, and everything lands attribute-escaped.
+# may reach an href, whatever their case, and everything lands
+# attribute-escaped.
 test_expect_success 'set up a hostile .gitmodules' '
 	(
 		cd repos/modlink &&
-		sub=$(git rev-parse HEAD) &&
-		git update-index --add --cacheinfo 160000,$sub,quoted &&
+		tip=$(git rev-parse HEAD) &&
+		for path in quoted upper data vbs file
+		do
+			git update-index --add --cacheinfo 160000,$tip,$path || return 1
+		done &&
 		cat >.gitmodules <<-EOF &&
 		[submodule "submod"]
 			path = submod
 			url = javascript:alert(1)
+		[submodule "upper"]
+			path = upper
+			url = JavaScript:alert(1)
+		[submodule "data"]
+			path = data
+			url = data:text/html,x
+		[submodule "vbs"]
+			path = vbs
+			url = vbscript:x
+		[submodule "file"]
+			path = file
+			url = file:///etc/passwd
 		[submodule "quoted"]
 			path = quoted
 			url = https://example.com/x'\''><script>alert(1)</script>
@@ -318,15 +334,16 @@ test_expect_success 'set up a hostile .gitmodules' '
 	cgitrc_repo modlinkgmrc modlink enable-gitmodules-links=1
 '
 
-test_expect_success 'a javascript url never reaches an href' '
-	cgit_rc modlinkgmrc "url=modlink/tree/" >tmp &&
-	! grep "href=.javascript:" tmp &&
-	grep "class=.ls-mod. title=.javascript:alert(1).>submod</span>" tmp
-'
-
-test_expect_success 'a quote in a web url cannot break out of the href' '
-	! grep "<script>alert" tmp &&
-	grep "href=.https://example.com/x&#x27;&gt;&lt;script&gt;" tmp
+test_expect_success 'only a web url reaches an href, escaped' '
+	cgit_ok modlinkgmrc "url=modlink/tree/" >tmp &&
+	test_grep "class=.ls-mod. title=.javascript:alert(1).>submod</span>" tmp &&
+	test_grep "class=.ls-mod. title=.JavaScript:alert(1).>upper</span>" tmp &&
+	test_grep "class=.ls-mod. title=.data:text/html,x.>data</span>" tmp &&
+	test_grep "class=.ls-mod. title=.vbscript:x.>vbs</span>" tmp &&
+	test_grep "class=.ls-mod. title=.file:///etc/passwd.>file</span>" tmp &&
+	test_grep ! -i -e "href=.javascript:" -e "href=.data:" -e "href=.vbscript:" -e "href=.file:" tmp &&
+	test_grep "href=.https://example.com/x&#x27;&gt;&lt;script&gt;alert(1)&lt;/script&gt;.>quoted</a>" tmp &&
+	test_grep ! "<script>alert" tmp
 '
 
 # The classes behind cgit's published advisories, each pinned against the
-- 
cgit 2.12.1