From f682975129f40521de4e11d7b21eca04a8d214f1 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 16:00:53 -1000 Subject: Test the leading slashes stripped from a url Nothing showed that every leading slash goes, through url= or PATH_INFO, and one left behind joins the virtual root into a scheme-relative link to another host. --- tests/t0301-security.sh | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'tests') diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 47d1a0a..092e0a9 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -457,6 +457,22 @@ test_expect_success 'the advisory payloads fail the same way through PATH_INFO' test_path_is_missing repos/cve/pwned ' +# Every leading slash goes, or a url opening with two would come out of the +# virtual root as a scheme-relative link to another host. +test_expect_success 'a url opening with slashes links only below the site' ' + cgitrc_copy slashrc && + cgit_rc slashrc "url=//evil.example/" >tmp && + test_grep "action=./evil.example/.>" tmp && + test_grep ! -e "href=.//" -e "action=.//" tmp && + cgit_path slashrc //evil.example/ >tmp && + test_grep "action=./evil.example/.>" tmp && + test_grep ! -e "href=.//" -e "action=.//" tmp && + cgit_ok slashrc "url=//f" >tmp && + test_grep "action=./f.>" tmp && + cgit_ok_path slashrc //f >tmp && + test_grep "action=./f.>" tmp +' + # An untrusted response hands over repository bytes as they are. An image # keeps its own type, SVG among them, so script inside one is held back by # the policy alone. The cache listing prints keys visitors chose. -- cgit 2.12.1