index : cgit

#!/bin/sh

# Collects the regression tests for the security fixes and for the behaviour
# this fork adds on top of upstream cgit. Each case builds the smallest
# repository and config that reproduce the original problem and then asks
# for the page that used to mishandle it.

test_description='Check security fixes and fork-specific behaviour'
. ./setup.sh

# The shipped server configs hand cgit the path as PATH_INFO, which the
# server has already decoded, so a hostile byte arrives there raw rather
# than through url=.
cgit_path() {
	CGIT_CONFIG="$PWD/$1" PATH_INFO=$2 cgit
}

cgit_ok_path() {
	(
		PATH_INFO=$2 &&
		export PATH_INFO &&
		cgit_ok "$1" ""
	)
}

# Some cases below share one repository and one config, so the fixture
# carries everything they need at once, readmes holding markup that must not
# reach the page as markup and a subdirectory to sort ahead of the files.
# The blob limit is the lowest there is, 1 KB, so a small file shows that a
# blob under it is still served.
test_expect_success 'set up security fixtures' '
	mkrepo repos/sec 1 &&
	(
		cd repos/sec &&
		printf "# Title\n<script>alert(1)</script>\n" >README.md &&
		printf "<script>alert(2)</script>\n" >readme.txt &&
		printf "top\n" >afile &&
		mkdir zsub &&
		printf "inner\n" >zsub/inner &&
		git add -A &&
		git commit -m fixtures
	) &&
	cgitrc_repo seccgitrc sec max-blob-size=1 enable-tree-group-dirs=1
'

# A revision beginning with a dash reaches git as an option rather than as a
# tip, so a request for id=--output=<path> could create or truncate any file
# the server is able to write. The request check and the log page refuse it
# with the same words, so the page cannot tell which of them did.
test_expect_success 'log id=--output is refused without writing a file' '
	cgitrc_copy nocacherc &&
	cgit_rc nocacherc "url=foo/log&id=--output=$PWD/log-output" >tmp &&
	test_grep "^Status: 400" tmp &&
	test_grep "<div class=.error.>Invalid revision</div>" tmp &&
	test_path_is_missing log-output
'

test_expect_success 'a valid id= still renders the log' '
	sha=$(git -C repos/foo rev-parse HEAD) &&
	cgit_ok_url "foo/log&id=$sha" >tmp &&
	test_grep ">commit 5</a>" tmp
'

test_expect_success 'a small blob is still served' '
	cgit_ok seccgitrc "url=sec/plain/afile" >tmp &&
	strip_headers <tmp >body &&
	echo top >expect &&
	test_cmp expect body
'

# A readme is repository content, so with no about filter configured it has
# to reach the page escaped instead of as live markup, whatever its name
# suggests about the format.
test_expect_success 'markdown readme without a filter is escaped as plain text' '
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "repo.url=md" &&
		echo "repo.path=$PWD/repos/sec/.git" &&
		echo "repo.readme=master:README.md" &&
		echo "repo.url=txt" &&
		echo "repo.path=$PWD/repos/sec/.git" &&
		echo "repo.readme=master:readme.txt"
	} >secreadmerc &&
	cgit_ok secreadmerc "url=md/about/" >tmp &&
	test_grep "pre class=.plaintext.># Title$" tmp &&
	test_grep "^&lt;script&gt;alert(1)&lt;/script&gt;$" tmp &&
	test_grep ! "<script>alert(1)</script>" tmp
'

test_expect_success 'non-markdown readme without a filter is escaped as plain text' '
	cgit_ok secreadmerc "url=txt/about/" >tmp &&
	test_grep "pre class=.plaintext.>&lt;script&gt;alert(2)&lt;/script&gt;$" tmp &&
	test_grep ! "<script>alert(2)</script>" tmp
'

# root-readme is the site's own file rather than repository content, so it
# goes out as written, on an about page of its own.
test_expect_success 'root-readme without a filter is its own page, as written' '
	echo "<b>site</b>" >root.html &&
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "root-readme=$PWD/root.html"
	} >secrootrc &&
	cgit_rc secrootrc "url=" >tmp &&
	grep "<li><a title=.About this site. href=./?p=about.>about</a>" tmp &&
	! grep "<b>site</b>" tmp &&
	cgit_rc secrootrc "p=about" >tmp &&
	grep "^<b>site</b>$" tmp
'

# A Content-Security-Policy without unsafe-inline stops an inline onchange
# handler from ever running, so the option form submits through a plain
# button and its selects carry no handlers at all, and nor does any other
# page.
test_expect_success 'diff options submit through a button' '
	sha=$(git -C repos/foo rev-parse HEAD) &&
	cgit_ok_url "foo/commit&id=$sha" >tmp &&
	test_grep "type=.submit. value=.reload." tmp &&
	test_grep ! " on[a-z]*=" tmp
'

test_expect_success 'no page carries an inline handler' '
	for page in repolist: summary:foo/ log:foo/log/ tree:foo/tree/ diff:foo/diff/ \
		refs:foo/refs/
	do
		cgit_ok_url "${page#*:}" >tmp &&
		test_grep "data-page=.${page%%:*}." tmp &&
		test_grep ! " on[a-z]*=" tmp || return 1
	done
'

# Grouping directories ahead of files is behaviour this fork adds, so nothing
# upstream covers it.
test_expect_success 'tree groups directories before files' '
	cgit_rc seccgitrc "url=sec/tree/" >tmp &&
	dirline=$(grep -n "tree/zsub" tmp | head -n 1 | cut -d: -f1) &&
	fileline=$(grep -n "tree/afile" tmp | head -n 1 | cut -d: -f1) &&
	test -n "$dirline" &&
	test -n "$fileline" &&
	test "$dirline" -lt "$fileline"
'

# A file name is repository content and may hold a quote, which would break
# out of the href attribute on the line number links of a side-by-side diff,
# or a hash or question mark, which the attribute escaping leaves alone and
# a browser would read as the end of the path. So the path is percent-encoded
# on its way into them.
test_expect_success 'ssdiff percent-encodes the file path in its line links' '
	mkrepo repos/xss 1 &&
	quoted=$(printf "x\047y.txt") &&
	(
		cd repos/xss &&
		printf "a\nb\n" >"$quoted" &&
		printf "a\nb\n" >"p#q?.txt" &&
		git add -A &&
		git commit -m add &&
		printf "a\nc\n" >"$quoted" &&
		printf "a\nc\n" >"p#q?.txt" &&
		git commit -am change
	) &&
	cgitrc_repo xssrc xss &&
	old=$(git -C repos/xss rev-parse HEAD~1) &&
	new=$(git -C repos/xss rev-parse HEAD) &&
	cgit_ok xssrc "url=xss/diff/&id=$new&ss=1" >tmp &&
	for path in x%27y.txt p%23q%3F.txt
	do
		test_grep "<td class=.lineno.><a href=./xss/tree/$path?id=$old#n2.>2</a></td>" tmp &&
		test_grep "<td class=.lineno.><a href=./xss/tree/$path?id=$new#n2.>2</a></td>" tmp || return 1
	done
'

# git itself will write a commit with an empty message, so the log and the
# summary both have to have something to print where the subject goes.
test_expect_success 'a message-less commit renders without crashing' '
	mkrepo repos/nomsg 1 &&
	(
		cd repos/nomsg &&
		tree=$(git write-tree) &&
		printf "tree %s\nauthor a <a@b> 1735689600 +0000\ncommitter a <a@b> 1735689600 +0000\n" "$tree" >raw &&
		cid=$(git hash-object -t commit -w raw) &&
		git update-ref refs/heads/master "$cid"
	) &&
	cgitrc_repo nomsgrc nomsg &&
	cgit_rc nomsgrc "url=nomsg/log/&showmsg=1" >tmp &&
	grep "no commit message" tmp &&
	cgit_rc nomsgrc "url=nomsg/" >tmp &&
	grep "no commit message" tmp
'

# A branch need not point at a commit. struct refinfo keeps taginfo and
# commitinfo in a union and fills only the member matching the object type,
# so sorting branches through the commit member read past the end of the
# smaller taginfo, which only a sanitizer build catches, and read NULL for a
# tree, which crashed. git update-ref refuses to create such a ref, hence
# the loose files written by hand below, and a repository is only files on
# disk so cgit meets whatever is there. A branch with a newer commit tells
# the two sort orders apart.
test_expect_success REFFILES 'set up a repo whose branches point at odd objects' '
	mkrepo repos/oddref 2 &&
	(
		cd repos/oddref &&
		git tag -a annotated -m note &&
		git rev-parse annotated >.git/refs/heads/points-at-tag &&
		git rev-parse HEAD^{tree} >.git/refs/heads/points-at-tree &&
		git checkout -q -b newer &&
		test_tick &&
		git commit -q --allow-empty -m newer &&
		git checkout -q master &&
		git for-each-ref refs/heads/ >refs.out &&
		grep -q "tree.refs/heads/points-at-tree" refs.out &&
		grep -q "tag.refs/heads/points-at-tag" refs.out
	) &&
	cgitrc_repo oddrefrc oddref branch-sort=age &&
	cgitrc_repo oddrefnamerc oddref branch-sort=name
'

# The line holding a branch's row, so a test can compare the order of rows.
branch_row() {
	grep -n "<tr class=.branch.><td><a href=[^>]*>$1</a>" "$2" | cut -d: -f1
}

test_expect_success REFFILES 'the refs, branch and summary pages sort such branches' '
	for page in refs/ refs/heads/ ""
	do
		cgit_ok oddrefrc "url=oddref/$page" >tmp &&
		test_grep "<option value=.points-at-tree.>" tmp &&
		test_grep "<tr class=.branch.><td><a href=./oddref/log/?h=points-at-tag.>" tmp &&
		test $(branch_row newer tmp) -lt $(branch_row master tmp) || return 1
	done
'

test_expect_success REFFILES 'name-sorted branches are unaffected' '
	cgit_ok oddrefnamerc "url=oddref/refs/heads/" >tmp &&
	test_grep "<option value=.points-at-tree.>" tmp &&
	test $(branch_row master tmp) -lt $(branch_row newer tmp) &&
	test $(branch_row newer tmp) -lt $(branch_row points-at-tag tmp)
'

# module-link is a template and a trusted scan lets a repository set its own
# from a cgitrc in the tree, so handing that string to printf let the owner
# of a scanned repository crash the process, or read stack memory into the
# served page, merely by adding conversions past the two that are filled.
# The tests after the fixture also pin down the templates that must keep
# working.
test_expect_success 'set up a submodule fixture with a hostile module-link' '
	mkrepo repos/modlink 1 &&
	sub=$(git -C repos/modlink rev-parse HEAD) &&
	(
		cd repos/modlink &&
		git update-index --add --cacheinfo 160000,$sub,submod &&
		git commit -m gitlink
	) &&
	mkdir -p scan &&
	cp -R repos/modlink scan/modlink &&
	printf "module-link=/m/%%s/%%s/%%s/%%s/%%s/%%s/%%s/%%s/%%s/%%s\n" >scan/modlink/.git/cgitrc &&
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "trust-scan-config=1" &&
		echo "scan-path=$PWD/scan"
	} >modlinkrc
'

test_expect_success 'a surplus conversion is shown literally, not filled' '
	sub=$(git -C scan/modlink rev-parse HEAD:submod) &&
	cgit_ok modlinkrc "url=modlink/tree/" >tmp &&
	test_grep "href=./m/submod/$sub/%s/%s/%s/%s/%s/%s/%s/%s.>submod</a>" tmp
'

test_expect_success 'a well-formed module-link still takes name and sha1' '
	cgitrc_repo modlinkokrc modlink "module-link=/mod/%s/commit/?id=%s" &&
	cgit_rc modlinkokrc "url=modlink/tree/" >tmp &&
	grep "href=./mod/submod/commit/?id=$sub." tmp
'

test_expect_success 'a per-path module-link takes only the sha1' '
	cgitrc_repo modlinkpathrc modlink "repo.module-link.submod=https://example.com/s/?id=%s" &&
	cgit_rc modlinkpathrc "url=modlink/tree/" >tmp &&
	grep "href=.https://example.com/s/?id=$sub." tmp
'

test_expect_success 'a doubled percent in a module-link renders as one' '
	cgitrc_repo modlinkpctrc modlink "module-link=/m/%s/%%/%s" &&
	cgit_rc modlinkpctrc "url=modlink/tree/" >tmp &&
	grep "href=./m/submod/%/$sub." tmp
'

# An unknown page under a repository used to reach the page header with no
# head resolved and crash in the branch switcher.
test_expect_success 'an unknown page under a repository answers 404 with its header' '
	cgitrc_copy nocacherc &&
	cgit_rc nocacherc "url=foo/nonsense/" >tmp &&
	test_grep "^Status: 404 Not Found" tmp &&
	test_grep "Invalid request" tmp &&
	test_grep "<select name=.h. " tmp
'

test_expect_success 'a clone endpoint with http clone off answers the same way' '
	cgitrc_copy noclonerc enable-http-clone=0 &&
	cgit_rc noclonerc "url=foo/info/refs" >tmp &&
	test_grep "^Status: 404 Not Found" tmp &&
	test_grep "Invalid request" tmp &&
	test_grep "<select name=.h. " tmp
'

# The .gitmodules file is commit-controlled content, so a derived link may
# carry any scheme and any byte an author can commit. Only http and https
# may reach an href, whatever their case, and everything lands
# attribute-escaped.
test_expect_success 'set up a hostile .gitmodules' '
	(
		cd repos/modlink &&
		tip=$(git rev-parse HEAD) &&
		for path in quoted upper data vbs file
		do
			git update-index --add --cacheinfo 160000,$tip,$path || return 1
		done &&
		cat >.gitmodules <<-EOF &&
		[submodule "submod"]
			path = submod
			url = javascript:alert(1)
		[submodule "upper"]
			path = upper
			url = JavaScript:alert(1)
		[submodule "data"]
			path = data
			url = data:text/html,x
		[submodule "vbs"]
			path = vbs
			url = vbscript:x
		[submodule "file"]
			path = file
			url = file:///etc/passwd
		[submodule "quoted"]
			path = quoted
			url = https://example.com/x'\''><script>alert(1)</script>
		EOF
		git add .gitmodules &&
		git commit -m hostile
	) &&
	cgitrc_repo modlinkgmrc modlink enable-gitmodules-links=1
'

test_expect_success 'only a web url reaches an href, escaped' '
	cgit_ok modlinkgmrc "url=modlink/tree/" >tmp &&
	test_grep "class=.ls-mod. title=.javascript:alert(1).>submod</span>" tmp &&
	test_grep "class=.ls-mod. title=.JavaScript:alert(1).>upper</span>" tmp &&
	test_grep "class=.ls-mod. title=.data:text/html,x.>data</span>" tmp &&
	test_grep "class=.ls-mod. title=.vbscript:x.>vbs</span>" tmp &&
	test_grep "class=.ls-mod. title=.file:///etc/passwd.>file</span>" tmp &&
	test_grep ! -i -e "href=.javascript:" -e "href=.data:" -e "href=.vbscript:" -e "href=.file:" tmp &&
	test_grep "href=.https://example.com/x&#x27;&gt;&lt;script&gt;alert(1)&lt;/script&gt;.>quoted</a>" tmp &&
	test_grep ! "<script>alert" tmp
'

# The classes behind cgit's published advisories, each pinned against the
# current code: a newline in a file name splitting the headers, a posted
# length overflowing its buffer, a path climbing out on the dumb transport
# and the about page, a commit with an empty author, a percent sign with no
# digits behind it, script in a file name shown by the diff, and shell
# syntax in a file name handed to a filter.
test_expect_success 'set up the advisory fixtures' '
	mkrepo repos/cve 1 &&
	(
		cd repos/cve &&
		printf "x\n" >"$(printf "crlf\r\nX-Injected: 1.txt")" &&
		printf "x\n" >"<script>alert(1)x.txt" &&
		printf "x\n" >"\$(touch pwned).c" &&
		git add -A &&
		git commit -m names &&
		parent=$(git rev-parse HEAD) &&
		echo noname >noname.txt &&
		git add noname.txt &&
		tree=$(git write-tree) &&
		git rm -q --cached noname.txt &&
		rm noname.txt &&
		printf "tree %s\nparent %s\n" "$tree" "$parent" >raw &&
		printf "author  <> 1735689600 +0000\ncommitter  <> 1735689600 +0000\n\nempty author\n" >>raw &&
		cid=$(git hash-object --literally -t commit -w raw) &&
		git update-ref refs/heads/noname "$cid"
	) &&
	mkdir -p readme &&
	printf "readme text\n" >readme/README &&
	write_script auth.sh <<-\EOF &&
	case "$1" in
	authenticate-post)
		wc -c >received
		printf "Status: 302 Found\nLocation: /\n\n"
		;;
	esac
	exit 1
	EOF
	cgitrc_repo cverc cve "auth-filter=exec:$PWD/auth.sh" "repo.readme=$PWD/readme/README" "repo.source-filter=exec:$FILTER_DIRECTORY/dump.sh"
'

test_expect_success 'a newline in a file name cannot split the headers' '
	cgit_rc cverc "url=cve/plain/crlf%0d%0aX-Injected:%201.txt" >tmp &&
	grep "^Status: 200" tmp &&
	! grep "^X-Injected" tmp &&
	grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.txt.$" tmp
'

# The body has to outgrow the 4096 byte buffer, or an unclamped read would
# still stop at the end of the body and nothing would overflow. A length of
# -1 reaches cgit as the largest number strtoul can return.
test_expect_success 'a posted length past any buffer is clamped' '
	test_seq 2000 >body &&
	for length in 99999999999999 -1
	do
		rm -f received &&
		CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=$length \
			QUERY_STRING="p=login" cgit <body >tmp &&
		test_grep "^Status: 302" tmp &&
		test $(cat received) = 4096 || return 1
	done &&
	CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=10 \
		QUERY_STRING="p=login" cgit <body >tmp &&
	test $(cat received) = 10
'

# The dumb transport serves a file below objects only by the shape a client
# asks for, so no spelling of a path climbs out or reaches the alternates
# file, which names object directories by their path on the server.
test_expect_success 'the dumb transport serves nothing but objects and packs' '
	echo "$PWD/repos/foo/.git/objects" >repos/cve/.git/objects/info/alternates &&
	test_when_finished "rm repos/cve/.git/objects/info/alternates" &&
	for path in ../config info/../../config info/alternates info//alternates \
		info/./alternates ./info/alternates info/Alternates /info/alternates
	do
		cgit_rc cverc "url=cve/objects/$path" >tmp &&
		test_grep "^Status: 404" tmp &&
		test_grep ! -e repositoryformatversion -e repos/foo tmp || return 1
	done &&
	cgit_ok cverc "url=cve/HEAD" >tmp &&
	test_grep "^ref: refs/heads/master$" tmp &&
	blob=$(git -C repos/cve rev-parse HEAD:file-1) &&
	cgit_ok cverc "url=cve/objects/$(test_oid_to_path $blob)" >tmp &&
	test_grep "^Content-Type: application/octet-stream$" tmp
'

test_expect_success 'the about page serves nothing above the readme directory' '
	cgit_rc cverc "url=cve/about/../cverc" >tmp &&
	grep "^Status: 404" tmp &&
	! grep "virtual-root" tmp &&
	cgit_rc cverc "url=cve/about/" >tmp &&
	grep "readme text" tmp
'

test_expect_success 'a commit with an empty author renders everywhere' '
	cgit_ok cverc "url=cve/log/&h=noname" >tmp &&
	test_grep ">empty author</a>" tmp &&
	cgit_ok cverc "url=cve/commit/&h=noname" >tmp &&
	test_grep "<div class=.commit-subject.>empty author<" tmp &&
	for page in "" refs/
	do
		cgit_ok cverc "url=cve/$page" >tmp &&
		test_grep "<a href=./cve/commit/?h=noname.>empty author</a></td><td class=.col-author.></td>" tmp || return 1
	done &&
	cgit_ok cverc "url=cve/patch/&h=noname" >tmp &&
	test_grep "^From:  <>$" tmp &&
	test_grep "^Subject: empty author$" tmp &&
	cgit_ok cverc "url=cve/atom/&h=noname" >tmp &&
	test_grep "<name>unknown</name>" tmp &&
	test_grep ! "<email></email>" tmp
'

test_expect_success 'a percent sign without digits behind it is read as itself' '
	cgit_ok cverc "url=cve/log/&q=%" >tmp &&
	test_grep "name=.q. aria-label=.Search. value=.%.>" tmp &&
	cgit_ok cverc "url=cve/log/&q=%zz%2" >tmp &&
	test_grep "name=.q. aria-label=.Search. value=.%zz%2.>" tmp
'

test_expect_success 'script in a file name is escaped on the diff page' '
	cgit_rc cverc "url=cve/diff/" >tmp &&
	! grep "<script>alert" tmp &&
	grep "&lt;script&gt;alert(1)x.txt" tmp
'

test_expect_success 'shell syntax in a file name reaches a filter as a plain argument' '
	cgit_ok cverc "url=cve/tree/%24(touch%20pwned).c" >tmp &&
	test_grep -F "\$(touch pwned).c X" tmp &&
	test_path_is_missing pwned &&
	test_path_is_missing repos/cve/pwned
'

test_expect_success 'the advisory payloads fail the same way through PATH_INFO' '
	cgit_ok_path cverc "/cve/plain/$(printf "crlf\r\nX-Injected: 1.txt")" >tmp &&
	test_grep ! "^X-Injected" tmp &&
	test_grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.txt.$" tmp &&
	for path in /cve/objects/../config /cve/objects/info/../../config /cve/about/../cverc
	do
		cgit_path cverc $path >tmp &&
		test_grep "^Status: 404" tmp &&
		test_grep ! -e repositoryformatversion -e virtual-root tmp || return 1
	done &&
	cgit_ok_path cverc /cve/HEAD >tmp &&
	test_grep "^ref: refs/heads/master$" tmp &&
	cgit_ok_path cverc /cve/about/ >tmp &&
	test_grep "readme text" tmp &&
	cgit_ok_path cverc "/cve/tree/\$(touch pwned).c" >tmp &&
	test_grep -F "\$(touch pwned).c X" tmp &&
	test_path_is_missing pwned &&
	test_path_is_missing repos/cve/pwned
'

# Every leading slash goes, or a url opening with two would come out of the
# virtual root as a scheme-relative link to another host.
test_expect_success 'a url opening with slashes links only below the site' '
	cgitrc_copy slashrc &&
	cgit_rc slashrc "url=//evil.example/" >tmp &&
	test_grep "action=./evil.example/.>" tmp &&
	test_grep ! -e "href=.//" -e "action=.//" tmp &&
	cgit_path slashrc //evil.example/ >tmp &&
	test_grep "action=./evil.example/.>" tmp &&
	test_grep ! -e "href=.//" -e "action=.//" tmp &&
	cgit_ok slashrc "url=//f" >tmp &&
	test_grep "action=./f.>" tmp &&
	cgit_ok_path slashrc //f >tmp &&
	test_grep "action=./f.>" tmp
'

# An untrusted response hands over repository bytes as they are. An image
# keeps its own type, SVG among them, so script inside one is held back by
# the policy alone. The cache listing prints keys visitors chose.
test_expect_success 'repository bytes go out under a policy that loads nothing' '
	mkrepo repos/svg 1 &&
	(
		cd repos/svg &&
		echo "<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(1)</script></svg>" >x.svg &&
		git add x.svg &&
		git commit -m svg
	) &&
	cgitrc_repo svgrc svg mimetype.svg=image/svg+xml &&
	cgit_ok svgrc "url=svg/plain/x.svg" >tmp &&
	test_grep "^Content-Type: image/svg+xml;" tmp &&
	test_grep "<script>alert(1)</script>" tmp &&
	for page in plain/x.svg blob/x.svg
	do
		cgit_ok svgrc "url=svg/$page" >tmp &&
		test_grep "^X-Content-Type-Options: nosniff$" tmp &&
		test_grep "^Content-Security-Policy: default-src .none.$" tmp || return 1
	done &&
	cgitrc_copy lscacherc &&
	cgit_ok lscacherc "p=ls_cache" >tmp &&
	test_grep "^Content-Type: text/plain;" tmp &&
	test_grep "^X-Content-Type-Options: nosniff$" tmp &&
	test_grep "^Content-Security-Policy: default-src .none.$" tmp
'

# Ref names, file names, messages and idents are all written by whoever can
# push, and git takes quotes, an ampersand and angle brackets in each, apart
# from the brackets in a name. Each has to be escaped for the context it
# lands in, and html_txt leaves quotes alone, so only a name holding both a
# quote and a bracket tells an attribute escaped as text.
test_expect_success 'set up a repository whose names and messages hold markup' '
	mkrepo repos/mk 1 &&
	(
		cd repos/mk &&
		echo hi >"$(printf "f\047\"<x>&.txt")" &&
		git add -A &&
		GIT_AUTHOR_NAME="au & \"q\" '\''s" GIT_COMMITTER_NAME="co & \"q\" '\''s" \
			git commit -m "subject <x> & \"q\" '\''s" -m "body <x> & \"q\" '\''s" &&
		git branch "br'\''\"<x>&" &&
		GIT_COMMITTER_NAME="tagger & \"q\" t" git tag -a -m "tag <x> & \"q\"" "tg'\''\"<x>&" &&
		git notes add -m "note <x> & \"q\""
	) &&
	cgitrc_repo mkrc mk snapshots=tar.gz
'

test_expect_success 'names and messages holding markup are escaped on every page' '
	cgit_ok mkrc "url=mk/" >tmp &&
	test_grep "<option value=.br&#x27;&quot;&lt;x&gt;&amp;.>br.\"&lt;x&gt;&amp;</option>" tmp &&
	test_grep "<a href=./mk/log/?h=br%27%22%3Cx%3E%26.>br.\"&lt;x&gt;&amp;</a>" tmp &&
	test_grep "<a href=./mk/tag/?h=tg%27%22%3Cx%3E%26.>tg.\"&lt;x&gt;&amp;</a>" tmp &&
	test_grep "<a href=./mk/snapshot/mk-tg%27%22%3Cx%3E%26.tar.gz.>mk-tg.\"&lt;x&gt;&amp;.tar.gz</a>" tmp &&
	test_grep "<td class=.col-author.>au &amp; \"q\" .s</td>" tmp &&
	test_grep "<td class=.col-author.>tagger &amp; \"q\" t</td>" tmp &&
	test_grep ! "<x>" tmp &&
	cgit_ok mkrc "url=mk/log/" >tmp &&
	test_grep ">subject &lt;x&gt; &amp; \"q\" .s</a>" tmp &&
	test_grep "<a class=.branch-deco. href=./mk/log/?h=br%27%22%3Cx%3E%26.>br.\"&lt;x&gt;&amp;</a>" tmp &&
	test_grep ! "<x>" tmp &&
	cgit_ok mkrc "url=mk/commit/" >tmp &&
	test_grep "<div class=.commit-subject.>subject &lt;x&gt; &amp; \"q\" .s<" tmp &&
	test_grep "<div class=.commit-msg.>body &lt;x&gt; &amp; \"q\" .s" tmp &&
	test_grep "<div class=.notes.>note &lt;x&gt; &amp; \"q\"" tmp &&
	test_grep "co &amp; \"q\" .s" tmp &&
	test_grep "<div class=.file. data-path=.f&#x27;&quot;&lt;x&gt;&amp;.txt.>" tmp &&
	test_grep ! "<x>" tmp &&
	cgit_ok mkrc "url=mk/commit/&dt=1" >tmp &&
	test_grep "<tbody class=.file. data-path=.f&#x27;&quot;&lt;x&gt;&amp;.txt.>" tmp &&
	test_grep ! "<x>" tmp &&
	cgit_ok mkrc "url=mk/tag/&h=tg%27%22%3Cx%3E%26" >tmp &&
	test_grep "<div class=.commit-subject.>tag &lt;x&gt; &amp; \"q\"</div>" tmp &&
	test_grep "tagger &amp; \"q\" t" tmp &&
	test_grep ! "<x>" tmp &&
	cgit_ok mkrc "url=mk/atom/" >tmp &&
	test_grep "<title>subject &lt;x&gt; &amp; \"q\" .s</title>" tmp &&
	test_grep "<content type=.text.>body &lt;x&gt; &amp; \"q\" .s" tmp &&
	test_grep "<name>au &amp; \"q\" .s</name>" tmp &&
	test_grep ! "<x>" tmp
'

# A page echoes the request in the search box, in the hidden inputs that
# carry a form's state, in the error naming what it refused and, from the
# Host header, in every absolute link.
test_expect_success 'request values echoed into a page are escaped' '
	payload=%27%3E%3Cs%3E &&
	escaped="&#x27;&gt;&lt;s&gt;" &&
	cgit_ok mkrc "url=mk/log/&q=$payload&qt=$payload&id=$payload" >tmp &&
	test_grep "name=.q. aria-label=.Search. value=.$escaped.>" tmp &&
	for name in q qt id
	do
		test_grep "<input type=.hidden. name=.$name. value=.$escaped.>" tmp || return 1
	done &&
	test_grep ! "<s>" tmp &&
	cgit_ok mkrc "url=mk/log/&h=br%27%22%3Cx%3E%26" >tmp &&
	test_grep "<input type=.hidden. name=.h. value=.br&#x27;&quot;&lt;x&gt;&amp;.>" tmp &&
	test_grep ! "<x>" tmp &&
	cgit_rc mkrc "url=mk/log/&h=%3Cb%3E" >tmp &&
	test_grep "<div class=.error.>Invalid branch: &lt;b&gt;</div>" tmp &&
	cgit_rc mkrc "url=mk/snapshot/%3Cb%3E.zzz" >tmp &&
	test_grep "<div class=.error.>Unsupported snapshot format: &lt;b&gt;.zzz</div>" tmp &&
	cgit_rc mkrc "url=mk/blob/%3Cb%3E" >tmp &&
	test_grep "<div class=.error.>Path not found: &lt;b&gt;</div>" tmp &&
	test_grep ! "<b>" tmp &&
	(
		HTTP_HOST="h'\''\"<x>" &&
		export HTTP_HOST &&
		cgit_ok mkrc "url=mk/" >tmp &&
		test_grep "<link rel=.alternate. title=.Atom feed. href=.http://h&#x27;&quot;&lt;x&gt;/mk/atom/?h=master." tmp &&
		test_grep ! "<x>" tmp &&
		cgit_ok mkrc "url=mk/atom/" >tmp &&
		test_grep "<id>http://h..&lt;x&gt;/mk/atom/</id>" tmp &&
		test_grep "<link rel=.alternate. type=.text/html. href=.http://h&#x27;&quot;&lt;x&gt;/mk/./>" tmp &&
		test_grep ! "<x>" tmp
	)
'

# With h= or id= given, a snapshot is named as requested rather than worked
# back to a ref, and a blob fetched by id takes whatever path the request
# names, so both reach the Content-Disposition header straight from the
# visitor.
test_expect_success 'a requested download name cannot split the headers' '
	crlf=crlf%0d%0aX-Injected:%201 &&
	cgit_ok mkrc "url=mk/snapshot/$crlf.tar.gz&h=master" >tmp &&
	sed -n "1,/^\$/p" tmp >headers &&
	test_grep "^Content-Type: application/gzip$" headers &&
	test_grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.tar.gz.$" headers &&
	test_grep ! "^X-Injected" headers &&
	blob=$(git -C repos/mk rev-parse HEAD:file-1) &&
	cgit_ok mkrc "url=mk/blob/&id=$blob&path=$crlf" >tmp &&
	sed -n "1,/^\$/p" tmp >headers &&
	test_grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.$" headers &&
	test_grep ! "^X-Injected" headers
'

# The about page of a repository without a readme sends the visitor on to
# the summary with the query string as it arrived, which a server hands over
# undecoded, so a byte no header line may carry is encoded on the way out.
test_expect_success 'a redirect keeps every query byte inside its Location' '
	cgitrc_copy redirectrc &&
	query=$(printf "x=a b\tc\r\nX-Injected: 1&y=\303\251\177") &&
	cgit_rc redirectrc "url=foo/about&$query" >tmp &&
	sed -n "1,/^\$/p" tmp >headers &&
	test_grep "^Status: 302" headers &&
	test_grep "^Location: /foo/?x=a%20b%09c%0D%0AX-Injected:%201&y=%C3%A9%7F$" headers &&
	test_grep ! "^X-Injected" headers
'

# Every link cgit makes to the snapshot and blame pages ends the page name
# with a slash, and the rules do too, so a file whose name only starts with
# either word stays open to crawlers.
test_expect_success 'robots.txt turns crawlers away from snapshots and blame' '
	grep -v "^#" "$TEST_OUTPUT_DIRECTORY/../assets/robots.txt" >rules &&
	cat >expect <<-\EOF &&
	User-agent: *
	Disallow: /*/snapshot/
	Disallow: /*/blame/
	EOF
	test_cmp expect rules
'

# A file name may hold any byte but a slash or a NUL, invalid UTF-8 and
# control bytes included, which only reach the tree through the index on a
# filesystem that refuses such names. Escaping is ASCII-based, so they need
# no entity, but a link has to carry them percent-encoded.
test_expect_success 'a file name of stray bytes is linked percent-encoded' '
	mkrepo repos/bytes 1 &&
	blob=$(git -C repos/bytes rev-parse HEAD:file-1) &&
	git -C repos/bytes update-index --add --cacheinfo "100644,$blob,$(printf "bad\377name")" &&
	git -C repos/bytes update-index --add --cacheinfo "100644,$blob,$(printf "ctl\001name")" &&
	git -C repos/bytes commit -q -m bytes &&
	cgitrc_repo bytesrc bytes &&
	cgit_ok bytesrc "url=bytes/tree/" >tmp &&
	test_grep "href=./bytes/tree/bad%FFname.>" tmp &&
	test_grep "href=./bytes/tree/ctl%01name.>" tmp &&
	cgit_ok bytesrc "url=bytes/tree/bad%FFname" >tmp &&
	test_grep "<div class=.blob-header.>blob: $blob " tmp
'

test_done