tests/t0302-home-access.shrev: 44c1d728b1 (latest)


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

#!/bin/sh

# Guards the promise that cgit reads nothing out of the home directory of
# whichever account the web server happens to run as. Every page is fetched
# under strace with HOME pointed at a path that is known not to exist, and
# the run fails if any call taking a path names it, which is how a stray
# read of a personal gitconfig would show up. The whole file class is traced
# rather than access alone, which is not a syscall of its own everywhere.

test_description='Ensure that git does not access $HOME'
. ./setup.sh

# strace needs ptrace, which a system can refuse even where the binary is
# installed, and a release that knows the file class of calls, so the probe
# traces that class.
test_lazy_prereq STRACE '
	strace -o /dev/null -e trace=%file true
'

test_have_prereq STRACE || {
	skip_all='Skipping access validation tests: no strace that can trace here'
	test_done
}

test_no_home_access() {
	missing_home=/path/to/some/place/that/does/not/possibly/exist &&
	strace \
		-E HOME="$missing_home" \
		-E CGIT_CONFIG="$PWD/cgitrc" \
		-E QUERY_STRING="url=$1" \
		-e trace=%file -f -o strace.out cgit &&
	! grep "$missing_home" strace.out
}

test_no_home_access_success() {
	test_expect_success "do not access \$HOME: $1" "
		test_no_home_access '$1'
	"
}

test_no_home_access_success
test_no_home_access_success foo
test_no_home_access_success foo/refs
test_no_home_access_success foo/log
test_no_home_access_success foo/tree
test_no_home_access_success foo/tree/file-1
test_no_home_access_success foo/commit
test_no_home_access_success foo/diff
test_no_home_access_success foo/patch
test_no_home_access_success foo/snapshot/master.tar.gz

test_done