From cd621f408fcc756280fb9d822d93aaca22ff9966 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 12:39:45 -1000 Subject: Test the blob page by object id Only a robustness test touched the blob page, so a request by bare id, the binary type, the untrusted headers and the refusal of a malformed id had no check. --- tests/t0105-plain.sh | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) (limited to 'tests') diff --git a/tests/t0105-plain.sh b/tests/t0105-plain.sh index 5364a0e..68832da 100755 --- a/tests/t0105-plain.sh +++ b/tests/t0105-plain.sh @@ -3,7 +3,8 @@ # The plain page hands over a repository's own bytes. A file with no better # guess is served as text unless its bytes look binary, a directory answers # with a bare listing of links, and a path that names nothing comes back as -# a 404 rather than an empty document. +# a 404 rather than an empty document. The blob page, which does the same +# for an object named by its id, is checked here too. test_description='Check content on plain page' . ./setup.sh @@ -108,6 +109,33 @@ test_expect_success 'a blob whose bytes look binary is served as octet-stream' ' sed "/^$/q" tmp | grep "^Content-Type: application/octet-stream$" ' +# The blob page hands over one object's bytes by its id alone, under the +# same untrusted headers as plain, with nothing in a tree to name a type by. +test_expect_success 'the blob page serves an object by its id' ' + blob=$(git -C repos/foo rev-parse master:file-1) && + cgit_ok_url "foo/blob/&id=$blob" >tmp && + sed "/^$/q" tmp >headers && + test_grep "^Content-Type: text/plain; charset=UTF-8$" headers && + test_grep "^X-Content-Type-Options: nosniff$" headers && + test_grep "^Content-Security-Policy: default-src .none.$" headers && + strip_headers body && + git -C repos/foo cat-file blob $blob >expect && + test_cmp expect body +' + +test_expect_success 'the blob page serves binary bytes as octet-stream' ' + blob=$(printf "\\000\\001" | git -C repos/foo hash-object -w --stdin) && + cgit_ok_url "foo/blob/&id=$blob" >tmp && + sed "/^$/q" tmp >headers && + test_grep "^Content-Type: application/octet-stream$" headers +' + +test_expect_success 'the blob page refuses an id that is no object id' ' + cgit_url "foo/blob/&id=xyz" >tmp && + test_grep "^Status: 404" tmp && + test_grep "
Bad object id: xyz
" tmp +' + # RFC 7303 names the XML types by an xml subtype or a +xml suffix, and those # take a charset like text does. A type that only spells xml inside a word, # as the Office formats do, is binary and gets none. -- cgit 2.12.1