From e4abbc45098a5c7e36969154513e00764a649b48 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 16:12:47 -1000
Subject: Check the order of branches at odd objects

points-at-tree only ever matched its entry in the branch switcher, and
points-at-tag was never looked for. Every branch also shared one date,
so the age and name sorts gave the same rows, and nothing showed the
name setting had applied. The loose refs written by hand need the
files backend.
---
 tests/t0301-security.sh | 41 +++++++++++++++++++++++++++--------------
 1 file changed, 27 insertions(+), 14 deletions(-)

(limited to 'tests')

diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 136df74..4bb187e 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -192,37 +192,50 @@ test_expect_success 'a message-less commit renders without crashing' '
 # A branch need not point at a commit. struct refinfo keeps taginfo and
 # commitinfo in a union and fills only the member matching the object type,
 # so sorting branches through the commit member read past the end of the
-# smaller taginfo, and read NULL for a tree, which crashed. git update-ref
-# refuses to create such a ref, hence the loose files written by hand below,
-# and a repository is only files on disk so cgit meets whatever is there.
-test_expect_success 'set up a repo whose branches point at odd objects' '
+# smaller taginfo, which only a sanitizer build catches, and read NULL for a
+# tree, which crashed. git update-ref refuses to create such a ref, hence
+# the loose files written by hand below, and a repository is only files on
+# disk so cgit meets whatever is there. A branch with a newer commit tells
+# the two sort orders apart.
+test_expect_success REFFILES 'set up a repo whose branches point at odd objects' '
 	mkrepo repos/oddref 2 &&
 	(
 		cd repos/oddref &&
 		git tag -a annotated -m note &&
 		git rev-parse annotated >.git/refs/heads/points-at-tag &&
 		git rev-parse HEAD^{tree} >.git/refs/heads/points-at-tree &&
+		git checkout -q -b newer &&
+		test_tick &&
+		git commit -q --allow-empty -m newer &&
+		git checkout -q master &&
 		git for-each-ref refs/heads/ >refs.out &&
 		grep -q "tree.refs/heads/points-at-tree" refs.out &&
 		grep -q "tag.refs/heads/points-at-tag" refs.out
 	) &&
-	cgitrc_repo oddrefrc oddref branch-sort=age
+	cgitrc_repo oddrefrc oddref branch-sort=age &&
+	cgitrc_repo oddrefnamerc oddref branch-sort=name
 '
 
-test_expect_success 'the refs, branch and summary pages sort such branches' '
+# The line holding a branch's row, so a test can compare the order of rows.
+branch_row() {
+	grep -n "<tr class=.branch.><td><a href=[^>]*>$1</a>" "$2" | cut -d: -f1
+}
+
+test_expect_success REFFILES 'the refs, branch and summary pages sort such branches' '
 	for page in refs/ refs/heads/ ""
 	do
-		cgit_rc oddrefrc "url=oddref/$page" >tmp &&
-		grep "points-at-tree" tmp &&
-		grep "</html>" tmp || return 1
+		cgit_ok oddrefrc "url=oddref/$page" >tmp &&
+		test_grep "<option value=.points-at-tree.>" tmp &&
+		test_grep "<tr class=.branch.><td><a href=./oddref/log/?h=points-at-tag.>" tmp &&
+		test $(branch_row newer tmp) -lt $(branch_row master tmp) || return 1
 	done
 '
 
-test_expect_success 'name-sorted branches are unaffected' '
-	sed "s/^branch-sort=age$/branch-sort=name/" oddrefrc >oddrefnamerc &&
-	cgit_rc oddrefnamerc "url=oddref/refs/heads/" >tmp &&
-	grep "points-at-tree" tmp &&
-	grep "</html>" tmp
+test_expect_success REFFILES 'name-sorted branches are unaffected' '
+	cgit_ok oddrefnamerc "url=oddref/refs/heads/" >tmp &&
+	test_grep "<option value=.points-at-tree.>" tmp &&
+	test $(branch_row master tmp) -lt $(branch_row newer tmp) &&
+	test $(branch_row newer tmp) -lt $(branch_row points-at-tag tmp)
 '
 
 # module-link is a template and a trusted scan lets a repository set its own
-- 
cgit 2.12.1