index : cgit

#!/bin/sh

# Regression tests from the audits of September and October 2026. Each case
# is a config, repository or request that used to crash cgit, end it inside
# git, or hand a visitor something other than what was asked for.

test_description='Check the audit regressions'
. ./setup.sh

# Writes a config to the file named first, rooted at / with the cache off,
# holding the settings named after it in order, for a site cgitrc_repo cannot
# describe, a scan or more than one repository say.
cgitrc_site() {
	cgitrc_site_file=$1
	shift
	printf '%s\n' virtual-root=/ cache-size=0 "$@" >"$cgitrc_site_file"
}

# Fails unless the response in the file named second opens with the status
# named first and carries no other, as a page that fails once its headers are
# out answers a second time below them.
expect_status() {
	sed -n 1p "$2" >status-line &&
	test_grep "^Status: $1 " status-line &&
	grep "^Status:" "$2" >status-lines &&
	test_line_count = 1 status-lines
}

# The tests that only read a repository share rob, and each test that changes
# one, or needs one in a shape of its own, builds it, so what a test finds
# does not hang on the tests that ran before it.
test_expect_success 'set up a repository and a config to vary' '
	mkrepo repos/rob 3 &&
	sha=$(git -C repos/rob rev-parse HEAD~1) &&
	cgitrc_repo robrc rob snapshots=tar.gz
'

test_expect_success 'a repository without a path answers 404' '
	cgitrc_site nopathrc repo.url=nopath repo.url=emptypath repo.path= &&
	for r in nopath emptypath
	do
		cgit_rc nopathrc "url=$r/log/" >tmp &&
		expect_status 404 tmp &&
		grep "Failed to open $r: Not a valid git repository" tmp || return 1
	done
'

# The index dates a repository from files under its path, and one without a
# path has none, whatever sits in the working directory.
test_expect_success 'a repository without a path has no age on the index' '
	cgitrc_site nopathagerc repo.url=nopath &&
	mkdir -p "(null)/refs/heads" &&
	>"(null)/refs/heads/master" &&
	cgit_ok nopathagerc "url=" >tmp &&
	test_grep ">nopath</a>" tmp &&
	test_grep "<td class=.col-idle.></td>" tmp &&
	test_grep ! "<time " tmp
'

test_expect_success 'a repository with an empty url is skipped with a warning' '
	cgitrc_site nourlrc repo.url= "repo.path=$PWD/repos/rob/.git" repo.desc=nourl \
		repo.url=rob "repo.path=$PWD/repos/rob/.git" &&
	cgit_rc nourlrc "url=rob/" >tmp 2>err &&
	expect_status 200 tmp &&
	grep "Ignoring repository with an empty url" err &&
	for query in url= r=
	do
		cgit_rc nourlrc "$query" >tmp 2>err &&
		expect_status 200 tmp &&
		test_grep ">rob</a>" tmp &&
		test_grep ! nourl tmp || return 1
	done
'

test_expect_success 'a scan path that is itself a repository is named after it' '
	cgitrc_site rootrc remove-suffix=1 "scan-path=$PWD/repos/rob" &&
	cgit_rc rootrc "url=" >tmp &&
	grep "toplevel-repo.><a href=./rob/.>rob</a>" tmp
'

test_expect_success 'a repo key after scan-path is reported instead of applied' '
	cgitrc_site stalerc repo.url=first "repo.path=$PWD/repos/rob/.git" "scan-path=$PWD/repos" repo.desc=misplaced &&
	cgit_rc stalerc "url=" >tmp 2>err &&
	! grep "misplaced" tmp &&
	grep "Ignoring repo.desc before any repo.url" err
'

test_expect_success 'a valueless or broken git config in a scanned repository is skipped' '
	git clone -q --bare repos/rob/.git scan/a.git &&
	printf "[cgit]\n\thide\n[cgit\n" >>scan/a.git/config &&
	cgitrc_site gitcfgrc enable-git-config=1 "scan-path=$PWD/scan" &&
	cgit_rc gitcfgrc "url=" >tmp 2>err &&
	grep "toplevel-repo.><a href=./a.git/.>" tmp &&
	grep "Ignoring unreadable config in $PWD/scan/a.git/config" err
'

# A repository's own cgitrc belongs to whoever can push to it, and each value
# below would reach the page once trusted. clone-url is even expanded from
# the request's environment, a visitor's cookie among it, into a page the
# cache then serves to others.
test_expect_success 'set up a scanned repository setting every key that waits on trust' '
	mkrepo scankeys/k 1 &&
	sub=$(git -C scankeys/k rev-parse HEAD) &&
	git -C scankeys/k update-index --add --cacheinfo 160000,$sub,sub &&
	git -C scankeys/k update-index --add --cacheinfo 160000,$sub,other &&
	git -C scankeys/k commit -q -m gitlinks &&
	write_script evil-filter.sh <<-\EOF &&
	echo "evil filter"
	cat
	EOF
	cat >scankeys/k/.git/cgitrc <<-EOF &&
	desc=from the repo
	readme=master:file-1
	about-filter=exec:$PWD/evil-filter.sh
	head-content=<script>alert(1)</script>
	logo=/evil/logo.png
	logo-link=https://evil.example/logo-link
	clone-url=https://evil.example/clone
	module-link=https://evil.example/module/%s
	module-link.sub=https://evil.example/path/%s
	EOF
	cgitrc_site scankeysrc "scan-path=$PWD/scankeys" &&
	cgitrc_site scankeystrustrc trust-scan-config=1 "scan-path=$PWD/scankeys"
'

test_expect_success 'only descriptive keys are taken from a scanned repository' '
	for page in about/ "" tree/
	do
		cgit_rc scankeysrc "url=k/$page" >tmp 2>err &&
		expect_status 200 tmp &&
		test_grep "<p class=.sub desc.>from the repo</p>" tmp &&
		test_grep ! "evil" tmp &&
		test_grep ! "alert(" tmp || return 1
	done &&
	for key in about-filter head-content logo logo-link clone-url module-link module-link.sub
	do
		test_grep "Ignoring $key in $PWD/scankeys/k/.git/: trust-scan-config is not set" err || return 1
	done &&
	cgit_rc scankeysrc "url=k/about/" >tmp &&
	test_grep "<pre class=.plaintext.>1$" tmp
'

test_expect_success 'with trust-scan-config the same keys apply' '
	sub=$(git -C scankeys/k rev-parse HEAD~1) &&
	cgit_ok scankeystrustrc "url=k/about/" >tmp &&
	test_grep "^<script>alert(1)</script></head>$" tmp &&
	test_grep "<a class=.logo. href=.https://evil.example/logo-link.><img src=./evil/logo.png." tmp &&
	test_grep "<div id=.about.>evil filter$" tmp &&
	cgit_ok scankeystrustrc "url=k/" >tmp &&
	test_grep "https://evil.example/clone" tmp &&
	cgit_ok scankeystrustrc "url=k/tree/" >tmp &&
	test_grep "href=.https://evil.example/path/$sub.>sub</a>" tmp &&
	test_grep "href=.https://evil.example/module/other.>other</a>" tmp
'

# A path on the server waits on trust, and so does a readme ending in a
# colon, which names no ref and is read as a path too.
test_expect_success 'a filesystem readme from a scanned repository is refused' '
	git clone -q --bare repos/rob/.git readmescan/b.git &&
	echo "outside the repository" >outside &&
	echo "outside the repository" >"readmescan/outside:" &&
	cgitrc_site readmescanrc "scan-path=$PWD/readmescan" &&
	cgitrc_site readmescantrustrc trust-scan-config=1 "scan-path=$PWD/readmescan" &&
	for readme in "$PWD/outside" ../outside:
	do
		echo "readme=$readme" >readmescan/b.git/cgitrc &&
		cgit_rc readmescanrc "url=b.git/about/" >tmp 2>err &&
		expect_status 302 tmp &&
		test_grep "Ignoring readme in $PWD/readmescan/b.git/: trust-scan-config is not set" err &&
		cgit_rc readmescantrustrc "url=b.git/about/" >tmp &&
		expect_status 200 tmp &&
		test_grep "outside the repository" tmp || return 1
	done
'

# The readme list is read as a page is served rather than copied at the
# scan-path line, so a readme set after the scan still applies.
test_expect_success 'a readme set after scan-path reaches a scanned repository' '
	git clone -q --bare repos/rob/.git laterscan/b.git &&
	cgitrc_site laterrc "scan-path=$PWD/laterscan" readme=master:file-1 &&
	cgit_rc laterrc "url=b.git/about/" >tmp &&
	grep "<pre class=.plaintext.>1$" tmp
'

# A repository served as html runs its pages on the site's own origin, so
# the switch waits on trust like the keys that place markup. The warning has
# to name the repository, which it did not for a key read from git config.
test_expect_success 'html serving from a scanned repository waits on trust' '
	mkrepo repos/html 1 &&
	test_commit -C repos/html --no-tag html page.html "<p>page</p>" &&
	mkdir -p scan2 &&
	git clone -q --bare repos/html/.git scan2/c.git &&
	git -C scan2/c.git config cgit.enable-html-serving 1 &&
	cgitrc_site htmlrc enable-git-config=1 mimetype.html=text/html "scan-path=$PWD/scan2" &&
	cgit_rc htmlrc "url=c.git/plain/page.html" >tmp 2>err &&
	grep "^Content-Type: text/plain" tmp &&
	grep "^X-Content-Type-Options: nosniff" tmp &&
	grep "Ignoring enable-html-serving in $PWD/scan2/c.git/: trust-scan-config is not set" err
'

# The repository and config are the ones the test above set up.
test_expect_success 'with trust-scan-config the same repository serves html' '
	cgitrc_site htmltrustrc trust-scan-config=1 enable-git-config=1 \
		mimetype.html=text/html "scan-path=$PWD/scan2" &&
	cgit_rc htmltrustrc "url=c.git/plain/page.html" >tmp &&
	grep "^Content-Type: text/html" tmp &&
	! grep "^X-Content-Type-Options" tmp
'

test_expect_success SYMLINKS 'a symlink cycle under the scan path is entered once' '
	mkdir loopscan &&
	git clone -q --bare repos/rob/.git loopscan/r.git &&
	ln -s . loopscan/loop &&
	cgitrc_site looprc "scan-path=$PWD/loopscan" &&
	cgit_ok looprc "url=" >tmp &&
	test_grep "<td class=.col-name toplevel-repo.><a href=./r.git/.>r.git</a>" tmp &&
	test $(grep -c "<tr class=.repo.>" tmp) = 1
'

test_expect_success 'a bare query parameter does not swallow the next one' '
	cgit_rc robrc "url=rob/commit/&x&id=$sha" >tmp &&
	grep "<div class=.commit-subject.>commit 2" tmp
'

# Whether cgit first sees the filter's exit status or its closed pipe
# depends on which side runs first, so either message will do.
test_expect_success 'a filter that cannot run answers one error page' '
	cgitrc_repo badfilterrc rob "commit-filter=exec:$PWD/no/such/filter" &&
	cgit_rc badfilterrc "url=rob/commit/" >tmp 2>err &&
	expect_status 200 tmp &&
	grep "Unable to complete the request" tmp &&
	grep -e "Unable to run filter $PWD/no/such/filter" -e "Unable to write the page" err &&
	grep "Unable to exec filter" err
'

# The filter may exit before or after cgit writes to it, so the page either
# completes or ends where the write failed. Either way cgit answers once and
# exits cleanly rather than dying of SIGPIPE. The file outgrows the pipe, so
# the write has to block and then fail however the two sides are scheduled.
test_expect_success 'a filter that exits without reading does not end cgit' '
	mkrepo repos/quit 1 &&
	test_commit -C repos/quit --no-tag big big.txt "$(test_seq 20000)" &&
	cgitrc_repo quitrc quit source-filter=exec:true &&
	cgit_rc quitrc "url=quit/tree/big.txt" >tmp 2>err &&
	expect_status 200 tmp &&
	test_grep "<div class=.blob-header.>blob: " tmp
'

test_expect_success 'a commit encoding header is read without its newline' '
	mkrepo repos/latin 1 &&
	(
		cd repos/latin &&
		echo more >file-1 &&
		git add file-1 &&
		git -c i18n.commitEncoding=ISO-8859-1 commit -m "$(printf "caf\351")"
	) &&
	cgitrc_repo latinrc latin &&
	cgit_rc latinrc "url=latin/commit/" >tmp &&
	grep "<div class=.commit-subject.>caf$(printf "\303\251")<" tmp
'

test_expect_success 'a path opening with a colon is refused on the log and patch pages' '
	cgit_rc robrc "url=rob/log/:%25x" >tmp &&
	expect_status 400 tmp &&
	cgit_rc robrc "url=rob/patch/:%25x" >tmp &&
	expect_status 400 tmp
'

test_expect_success 'a revision spelled like an option is refused' '
	mkrepo repos/optref 1 &&
	git -C repos/optref update-ref refs/heads/--stdin HEAD &&
	cgitrc_repo optrefrc optref &&
	cgit_rc optrefrc "url=optref/log/&h=--stdin" >tmp &&
	expect_status 404 tmp &&
	cgit_rc optrefrc "url=optref/blame/file-1&id=--stdin" >tmp &&
	expect_status 400 tmp &&
	cgit_rc optrefrc "url=optref/atom/&h=--stdin" >tmp &&
	expect_status 404 tmp
'

# Three tests read through the annotated tag set up here.
test_expect_success 'set up a repository with an annotated tag' '
	mkrepo repos/tagged 3 &&
	git -C repos/tagged tag -a -m note ann HEAD &&
	cgitrc_repo taggedrc tagged
'

test_expect_success 'the blob page reads a file through an annotated tag' '
	git -C repos/tagged cat-file blob ann:file-1 >want &&
	cgit_ok taggedrc "url=tagged/blob/&h=ann&path=file-1" >tmp &&
	strip_headers <tmp >body &&
	test_cmp want body
'

# The plain page walks a path out of whatever commit the id names, and the
# blob page used to answer such a request with the raw commit object.
test_expect_success 'the blob page walks a path out of the commit or tag the id names' '
	tip=$(git -C repos/tagged rev-parse HEAD) &&
	git -C repos/tagged cat-file blob HEAD:file-1 >want &&
	cgit_ok taggedrc "url=tagged/blob/file-1&id=$tip" >tmp &&
	strip_headers <tmp >body &&
	test_cmp want body &&
	tag=$(git -C repos/tagged rev-parse ann) &&
	git -C repos/tagged cat-file blob ann:file-1 >want &&
	cgit_ok taggedrc "url=tagged/blob/file-1&id=$tag" >tmp &&
	strip_headers <tmp >body &&
	test_cmp want body &&
	cgit_rc taggedrc "url=tagged/blob/missing&id=$tip" >tmp &&
	expect_status 404 tmp
'

test_expect_success 'a revision expression that walks the history is refused' '
	cgit_rc robrc "url=rob/log/&h=:/zzzz" >tmp &&
	expect_status 404 tmp &&
	cgit_rc robrc "url=rob/commit/&id=HEAD^{/zzzz}" >tmp &&
	expect_status 400 tmp &&
	cgit_rc robrc "url=rob/log/&qt=range&q=:/zzzz" >tmp &&
	expect_status 400 tmp &&
	cgit_rc robrc "url=rob/log/&qt=range&q=master~1..master" >tmp &&
	expect_status 400 tmp &&
	cgit_rc robrc "url=rob/log/&qt=range&q=$sha..master" >tmp &&
	expect_status 200 tmp
'

# git update-ref refuses a ref to an object it cannot parse, so the ref is
# written as a loose file, which only the files backend reads.
test_expect_success REFFILES 'a commit with a broken tree line does not crash the blob page' '
	git clone -q repos/rob broken &&
	git -C broken cat-file commit HEAD >commit &&
	sed "s/^tree .*/tree not-a-hash/" commit >bad-commit &&
	bad=$(git -C broken hash-object -t commit -w --literally "$PWD/bad-commit") &&
	echo $bad >broken/.git/refs/heads/bad &&
	cgitrc_repo brokenrc broken "repo.path=$PWD/broken/.git" repo.readme=:file-1 &&
	cgit_rc brokenrc "url=broken/blob/&h=bad&path=file-1" >tmp &&
	expect_status 404 tmp
'

test_expect_success 'a die inside git answers one 500 page and logs the reason' '
	git clone -q repos/rob badconfig &&
	printf "[core\n" >>badconfig/.git/config &&
	cgitrc_repo badconfigrc badconfig "repo.path=$PWD/badconfig/.git" &&
	cgit_rc badconfigrc "url=badconfig/log/" >tmp 2>err &&
	expect_status 500 tmp &&
	test_grep "bad config line" err &&
	test_grep ! "bad config line" tmp
'

# The log walks the history before it prints a row, so a missing commit ends
# the page before any of it, and the reason goes to the log alone.
test_expect_success 'a history with a missing parent answers one error' '
	test_create_repo gap &&
	test_commit -C gap --no-tag first &&
	test_commit -C gap --no-tag second &&
	test_commit -C gap --no-tag third &&
	older=$(git -C gap rev-parse HEAD~2) &&
	parent=$(git -C gap rev-parse HEAD~1) &&
	tip=$(git -C gap rev-parse HEAD) &&
	rm "gap/.git/objects/$(test_oid_to_path $parent)" &&
	cgitrc_repo gaprc gap "repo.path=$PWD/gap/.git" &&
	cgit_rc gaprc "url=gap/log/" >tmp 2>err &&
	expect_status 200 tmp &&
	test_grep "<div class=.error.>Unable to complete the request</div>" tmp &&
	test_grep "Failed to traverse parents of commit $tip" err &&
	cgit_rc gaprc "url=gap/patch/&id2=$older" >tmp &&
	expect_status 500 tmp
'

# The commit page collects each file's diff body before printing it, so a
# die while one is collected has to reach the page rather than the body.
test_expect_success 'a corrupt blob in a collected diff answers the error' '
	git init -q corrupt &&
	(
		cd corrupt &&
		test_seq 2000 >f &&
		git add f &&
		git commit -q -m one &&
		test_seq 2000 | sed "s/^5/X/" >f &&
		git commit -q -a -m two &&
		blob=$(git rev-parse HEAD:f) &&
		obj=.git/objects/$(test_oid_to_path $blob) &&
		size=$(wc -c <$obj) &&
		chmod u+w $obj &&
		test_copy_bytes $((size / 2)) <$obj >half &&
		mv half $obj
	) &&
	cgitrc_repo corruptrc corrupt "repo.path=$PWD/corrupt/.git" &&
	cgit_rc corruptrc "url=corrupt/commit/" >tmp 2>err &&
	expect_status 200 tmp &&
	test_grep "<div class=.error.>Unable to complete the request</div>" tmp &&
	test_grep "is corrupt" err
'

# Shells word the failed write differently, and dash names no broken pipe at
# all, so the test looks at whether the writer outlived the closed pipe. It
# puts out more than a pipe holds, so it meets the closed end whatever the
# timing, and it is a script of its own because a subshell of ksh stops at
# the failed write even with the signal ignored.
test_expect_success 'a filter pipeline sees the default SIGPIPE disposition' '
	write_script writer.sh <<-\EOF &&
	n=0
	while test $n -lt 20000
	do
		echo line
		n=$((n + 1))
	done
	echo outlived >"$PWD/outlived"
	EOF
	write_script pipe.sh <<-EOF &&
	"$PWD/writer.sh" | head -n 1
	EOF
	cgitrc_repo piperc rob "source-filter=exec:$PWD/pipe.sh" &&
	cgit_ok piperc "url=rob/tree/file-1" >tmp &&
	test_grep "<pre><code>line$" tmp &&
	test_path_is_missing outlived
'

# Such a branch is refused as a head, so the fallback passes over it, and the
# switcher must not offer a choice that can only lead to an error page.
test_expect_success 'the fallback branch skips a name spelled like an option' '
	mkrepo repos/fallback 1 &&
	git -C repos/fallback update-ref refs/heads/-first HEAD &&
	git -C repos/fallback symbolic-ref HEAD refs/heads/gone &&
	cgitrc_repo fallbackrc fallback &&
	cgit_ok fallbackrc "url=fallback/" >tmp &&
	test_grep "<option value=.master. selected>" tmp &&
	test_grep ! "<option value=.-first." tmp
'

# A cache that stored nothing would pass the first config whatever its ttl,
# so a second keeps the same page for ever and has to show it unchanged.
test_expect_success 'a refs page named with an id is not cached for ever' '
	mkrepo repos/ttl 1 &&
	cgitrc_repo ttlrc ttl cache-size=10 "cache-root=$PWD/ttlcache" \
		cache-static-ttl=-1 cache-dynamic-ttl=0 cache-summary-ttl=0 &&
	cgitrc_repo foreverrc ttl cache-size=10 "cache-root=$PWD/forevercache" \
		cache-static-ttl=-1 cache-dynamic-ttl=-1 cache-summary-ttl=0 &&
	mkdir ttlcache forevercache &&
	full=$(git -C repos/ttl rev-parse HEAD) &&
	cgit_ok ttlrc "url=ttl/refs/&id=$full" >tmp &&
	cgit_ok foreverrc "url=ttl/refs/&id=$full" >tmp &&
	git -C repos/ttl tag later HEAD &&
	cgit_ok ttlrc "url=ttl/refs/&id=$full" >tmp &&
	test_grep ">later<" tmp &&
	cgit_ok foreverrc "url=ttl/refs/&id=$full" >tmp &&
	test_grep "<tr class=.branch.>" tmp &&
	test_grep ! ">later<" tmp
'

test_lazy_prereq GZIP 'command -v gzip'

test_expect_success GZIP 'a snapshot of a tag spelled like an option is archived' '
	mkrepo repos/opttag 1 &&
	git -C repos/opttag update-ref refs/tags/-l HEAD &&
	cgitrc_repo opttagrc opttag snapshots=tar.gz &&
	cgit_ok opttagrc "url=opttag/snapshot/-l.tar.gz" >tmp &&
	strip_headers <tmp >archive.tar.gz &&
	gzip -dc archive.tar.gz >archive.tar &&
	tar -tf archive.tar >list &&
	test_grep "^-l/file-1$" list
'

test -n "$CGIT_VALGRIND" || test_set_prereq NO_VALGRIND

test_expect_success NO_VALGRIND 'a snapshot format whose compressor is missing answers 500' '
	cgitrc_repo xzrc rob snapshots=tar.xz &&
	cgitbin=$(command -v cgit) &&
	mkdir -p nobin &&
	PATH="$PWD/nobin" CGIT_CONFIG="$PWD/xzrc" \
		QUERY_STRING="url=rob/snapshot/rob-master.tar.xz" "$cgitbin" >tmp &&
	expect_status 500 tmp
'

test_expect_success 'a tag pointing at a tag links the inner tag by id' '
	git -C repos/tagged tag -a -m outer outer ann &&
	inner=$(git -C repos/tagged rev-parse ann) &&
	cgit_ok taggedrc "url=tagged/tag/&h=outer" >tmp &&
	test_grep "<th scope=.row.>tagged object</th><td class=.oid.><a href=./tagged/tag/?h=outer&amp;id=$inner.>tag $inner</a>" tmp &&
	cgit_ok taggedrc "url=tagged/tag/&h=outer&id=$inner" >tmp &&
	test_grep "<th scope=.row.>tag name</th><td>$inner " tmp &&
	test_grep "<div class=.commit-subject.>note</div>" tmp
'

test_expect_success 'the dumb transport serves an empty repository' '
	git init -q --bare empty.git &&
	cgitrc_repo emptyrc empty "repo.path=$PWD/empty.git" &&
	cgit_rc emptyrc "url=empty/info/refs" >tmp &&
	expect_status 200 tmp &&
	grep "^Content-Type: text/plain" tmp &&
	cgit_rc emptyrc "url=empty/objects/info" >tmp &&
	expect_status 404 tmp
'

# A pack is handed over as it sits on the disk, so the client can be told
# its size up front and compare what arrived against it.
test_expect_success 'the dumb transport sends a file with its size' '
	mkrepo repos/packed 1 &&
	git -C repos/packed repack -q -d &&
	cgitrc_repo packedrc packed &&
	cgit_rc packedrc "url=packed/objects/info/packs" >tmp &&
	pack=$(strip_headers <tmp | sed -n "s/^P //p" | head -n 1) &&
	test -n "$pack" &&
	cgit_rc packedrc "url=packed/objects/pack/$pack" >tmp &&
	expect_status 200 tmp &&
	size=$(wc -c <repos/packed/.git/objects/pack/$pack | tr -d " ") &&
	grep "^Content-Length: $size$" tmp &&
	strip_headers <tmp >body &&
	cmp body repos/packed/.git/objects/pack/$pack
'

# A reftable repository keeps only a placeholder in its HEAD file, so the
# branch a client is to check out has to come from the refs instead.
test_expect_success 'the dumb transport answers HEAD from the refs' '
	cgit_rc robrc "url=rob/HEAD" >tmp &&
	expect_status 200 tmp &&
	strip_headers <tmp >head &&
	echo "ref: refs/heads/master" >expect &&
	test_cmp expect head &&
	git init -q --bare --ref-format=reftable -b trunk rt.git &&
	git -C repos/rob push -q "$PWD/rt.git" master:trunk &&
	cgitrc_repo rtrc rt "repo.path=$PWD/rt.git" &&
	cgit_rc rtrc "url=rt/HEAD" >tmp &&
	strip_headers <tmp >head &&
	echo "ref: refs/heads/trunk" >expect &&
	test_cmp expect head &&
	git init -q --bare emptyhead.git &&
	cgitrc_repo emptyheadrc emptyhead "repo.path=$PWD/emptyhead.git" &&
	cgit_rc emptyheadrc "url=emptyhead/HEAD" >tmp &&
	strip_headers <tmp >head &&
	echo "ref: refs/heads/master" >expect &&
	test_cmp expect head
'

test_expect_success 'a reftable repository shows its age on the index' '
	git init -q --bare --ref-format=reftable -b trunk rtage.git &&
	git -C repos/rob push -q "$PWD/rtage.git" master:trunk &&
	cgitrc_repo rtagerc rtage "repo.path=$PWD/rtage.git" &&
	cgit_rc rtagerc "url=" >tmp &&
	grep "<td class=.col-idle.><time " tmp
'

# A client that goes away mid-page leaves nobody to send an error page to,
# so the request ends quietly instead of dying twice into the log. The page
# has to outgrow the pipe for the write after the reader has gone to fail.
test_expect_success 'a client that disconnects ends the request quietly' '
	mkrepo repos/long 1 &&
	test_commit -C repos/long --no-tag long long.txt \
		"$(awk "BEGIN{for(i=0;i<20000;i++) print \"line \" i}")" &&
	cgitrc_repo longrc long &&
	{ cgit_rc longrc "url=long/tree/long.txt" 2>err; echo $? >status; } | test_copy_bytes 1 >/dev/null &&
	test "$(cat status)" = 0 &&
	! grep -i "broken pipe" err &&
	! grep "die()" err
'

# A page an auth filter let a visitor see is theirs alone, so a cache
# shared with other visitors has to be told, while a site without a filter
# keeps its pages free of any such header.
test_expect_success 'pages behind an auth filter are marked private' '
	write_script letin.sh <<-\EOF &&
	exit 1
	EOF
	cgitrc_repo letinrc rob "auth-filter=exec:$PWD/letin.sh" &&
	cgit_rc letinrc "url=rob/log/" >tmp &&
	expect_status 200 tmp &&
	grep "^Cache-Control: private$" tmp &&
	grep "^Vary: Cookie$" tmp &&
	cgit_ok robrc "url=rob/log/" >tmp &&
	test_grep ! "^Cache-Control" tmp &&
	test_grep ! "^Vary" tmp
'

# A repository without a readme sends its about page to the summary, and
# the branch asked for has to survive that hop.
test_expect_success 'the about redirect keeps the query string' '
	mkrepo repos/redirect 1 &&
	git -C repos/redirect branch other HEAD &&
	cgitrc_repo redirectrc redirect &&
	cgit_rc redirectrc "url=redirect/about&h=other&x=1" >tmp &&
	expect_status 302 tmp &&
	grep "^Location: /redirect/?h=other&x=1$" tmp &&
	cgitrc_repo redirectreadmerc redirect repo.readme=master:file-1 &&
	cgit_rc redirectreadmerc "url=redirect/about&h=other" >tmp &&
	expect_status 200 tmp
'

# A readme named without a branch is read from the head being browsed, and an
# annotated tag reaches its commit only through the tag object.
test_expect_success 'the readme follows an annotated tag as the head' '
	mkrepo repos/tagreadme 1 &&
	git -C repos/tagreadme tag -a -m release v1 HEAD &&
	cgitrc_repo tagreadmerc tagreadme repo.readme=:file-1 &&
	cgit_rc tagreadmerc "url=tagreadme/about/&h=v1" >tmp &&
	expect_status 200 tmp &&
	cgit_rc tagreadmerc "url=tagreadme/tree/&h=v1" >tmp &&
	grep ">about<" tmp
'

test_expect_success 'the about redirect encodes the repository url once' '
	cgit_url "foo%2Bbar/about/" >tmp &&
	expect_status 302 tmp &&
	grep "^Location: /foo%2Bbar/$" tmp
'

test_expect_success 'a symlink whose target is a large blob is listed without it' '
	mkrepo repos/biglink 1 &&
	printf "%05000d" 0 | tr 0 a >big-target &&
	big=$(git -C repos/biglink hash-object -w --stdin <big-target) &&
	test $(git -C repos/biglink cat-file -s $big) = 5000 &&
	(
		cd repos/biglink &&
		git update-index --add --cacheinfo 120000,$big,biglink &&
		git commit -m biglink
	) &&
	cgitrc_repo biglinkrc biglink &&
	cgit_ok biglinkrc "url=biglink/tree/" >tmp &&
	test_grep "<tr class=.link.>.*>biglink</a></td><td class=.ls-size.>5000<" tmp &&
	test_grep ! "aaaaaaaaaa" tmp
'

# The line has to carry the read error rather than the flag ferror returns.
# A system may open a directory and fail the read, or refuse the open, so the
# same error text is expected from either path.
test_expect_success 'an unreadable project list is named with its error' '
	mkdir -p projdir &&
	cgitrc_site projrc "project-list=$PWD/projdir" "scan-path=$PWD/repos" &&
	cgit_rc projrc "url=" >tmp 2>err &&
	grep "project list .*projdir: Is a directory" err
'

test_expect_success SANITY 'a scan entry that cannot be searched is named in full' '
	mkdir -p scanperm/locked &&
	test_when_finished "chmod 755 scanperm/locked" &&
	chmod 644 scanperm/locked &&
	cgitrc_site scanpermrc "scan-path=$PWD/scanperm" &&
	cgit_rc scanpermrc "url=" >tmp 2>err &&
	grep "Unable to stat .*scanperm/locked/objects: Permission denied" err
'

# A readme past max-blob-size is never read, so the about page says why it
# has nothing to show.
test_expect_success 'a readme past max-blob-size is reported on the about page' '
	mkrepo repos/bigreadme 1 &&
	test_commit -C repos/bigreadme --no-tag "big readme" big-readme "$(test_seq 1 1000)" &&
	cgitrc_repo bigreadmerc bigreadme max-blob-size=1 repo.readme=:big-readme &&
	cgit_rc bigreadmerc "url=bigreadme/about/" >tmp &&
	grep "The readme is larger than max-blob-size (1 KB)" tmp
'

# The chrome names a pinned commit in the title, and on an error page the id
# that was just refused must not be looked up to get there, since the wider
# revision syntax walks the whole history for a match.
test_expect_success 'the error page does not resolve the id it refused' '
	cgit_rc robrc "url=rob/log/&id=$sha" >tmp &&
	grep "<title>.* @ " tmp &&
	cgit_rc robrc "url=rob/log/&id=%3A/commit" >tmp &&
	expect_status 400 tmp &&
	test_grep "<title>Bad Request - rob - " tmp &&
	test_grep ! "<title>.* @ " tmp
'

# A notes ref a pusher pointed at something other than a tree made git die on
# loading it, which took every page of the repository down with it.
test_expect_success 'a notes ref that names no tree is passed over' '
	test_create_repo repos/notes &&
	test_commit -C repos/notes base &&
	blob=$(echo not-a-tree | git -C repos/notes hash-object -w --stdin) &&
	git -C repos/notes update-ref refs/notes/commits $blob &&
	git -C repos/notes update-ref refs/notes/signatures/tar $blob &&
	cgitrc_repo notesrc notes snapshots=tar &&
	for q in "url=notes/" "url=notes/log/" "url=notes/refs/" "url=notes/tree/"
	do
		cgit_ok notesrc "$q" >tmp || return 1
	done &&
	cgit_rc notesrc "url=notes/snapshot/notes-base.tar.asc" >tmp 2>err &&
	expect_status 404 tmp &&
	test_grep "<div class=.error.>No signature for notes-base.tar</div>" tmp &&
	test_grep ! "notes tree" err
'

# A scanned repository names its own default branch, which the index stats
# below the repository to date it, so the name is held to what a ref may be.
# The path runs through refs/heads, which reftable keeps as a file, so only
# the files backend shows the escape.
test_expect_success REFFILES 'a scanned defbranch cannot name a path outside the repository' '
	git clone -q --bare repos/rob/.git defscan/b.git &&
	mkdir -p secret &&
	touch -t 200001010000 secret/file &&
	echo "defbranch=../../../../secret/file" >defscan/b.git/cgitrc &&
	cgitrc_site defscanrc "scan-path=$PWD/defscan" &&
	cgit_rc defscanrc "url=" >tmp &&
	grep ">b.git</a>" tmp &&
	! grep "data-ut=.946" tmp
'

# HEAD is a file the repository's owner writes as well, and the index stats
# the branch it names below refs/heads to date the repository.
test_expect_success REFFILES 'a crafted HEAD cannot date a repository from outside it' '
	mkdir -p aimed &&
	touch -t 200001010000 aimed/file &&
	git init -q --bare headscan/h.git &&
	echo "ref: refs/heads/../../../../aimed/file" >headscan/h.git/HEAD &&
	cgitrc_site headrc "scan-path=$PWD/headscan" &&
	cgit_rc headrc "url=" >tmp &&
	expect_status 200 tmp &&
	test_grep ">h.git</a>" tmp &&
	test_grep ! "data-ut=.946" tmp
'

# Blame works on text alone, so a binary file is offered no blame link from
# its own page, and a request that names one anyway is told why.
test_expect_success 'blame turns away a binary file' '
	mkrepo repos/binblame 1 &&
	test_commit -C repos/binblame --no-tag --printf binary bin.dat "a\000b\n" &&
	cgitrc_repo binblamerc binblame repo.enable-blame=1 &&
	cgit_ok binblamerc "url=binblame/blame/bin.dat" >tmp &&
	test_grep "<div class=.error.>Blob is binary</div>" tmp &&
	test_grep ! "<table class=.blame blob.>" tmp &&
	cgit_ok binblamerc "url=binblame/tree/bin.dat" >tmp &&
	test_grep "<div class=.blob-header.>blob: " tmp &&
	test_grep ! "href=./binblame/blame/" tmp &&
	cgit_ok binblamerc "url=binblame/tree/file-1" >tmp &&
	test_grep "(<a href=./binblame/blame/file-1.>blame</a>)" tmp
'

# A scanned repository may set its description, owner and section without
# trust, so markup in them has to land escaped on the index and in the meta
# description of its own pages.
test_expect_success 'descriptive values from a scanned repository are escaped' '
	git clone -q --bare repos/rob/.git descscan/d.git &&
	cat >descscan/d.git/cgitrc <<-\EOF &&
	desc=desc <x> & "q" '\''s
	owner=owner <x> & "q" '\''s
	section=section <x> & "q" '\''s
	EOF
	cgitrc_site descrc enable-index-owner=1 "scan-path=$PWD/descscan" &&
	cgit_ok descrc "url=" >tmp &&
	test_grep "<a href=./d.git/.>desc &lt;x&gt; &amp; \"q\" .s</a>" tmp &&
	test_grep "<a href=./?q=owner+%3Cx%3E+%26+%22q%22+%27s.>owner &lt;x&gt; &amp; \"q\" .s</a>" tmp &&
	test_grep "class=.reposection.>section &lt;x&gt; &amp; \"q\" .s</td>" tmp &&
	test_grep ! "<x>" tmp &&
	cgit_ok descrc "url=d.git/" >tmp &&
	test_grep "<meta name=.description. content=.desc &lt;x&gt; &amp; &quot;q&quot; &#x27;s.>" tmp &&
	test_grep ! "<x>" tmp
'

# A repository's own config cannot point the mailmap reader at a file on the
# server or another blob, and git reads the mailmap whole, so one past
# max-blob-size is passed over like any other large blob.
test_expect_success 'only a .mailmap at HEAD within max-blob-size is applied' '
	test_create_repo repos/mapped &&
	(
		cd repos/mapped &&
		echo content >file &&
		git add file &&
		GIT_AUTHOR_NAME="Old Name" GIT_AUTHOR_EMAIL=old@example.com \
			git commit -q -m first &&
		echo "New Name <new@example.com> <old@example.com>" >.mailmap &&
		test_seq -f "# padding line %d" 1 200 >>.mailmap &&
		echo "Blob Name <blob@example.com> <old@example.com>" >other-map &&
		git add .mailmap other-map &&
		git commit -q -m "add the mailmaps" &&
		echo "File Name <file@example.com> <old@example.com>" >../map-on-disk &&
		git config mailmap.file "$PWD/../map-on-disk" &&
		git config mailmap.blob HEAD:other-map
	) &&
	test $(git -C repos/mapped cat-file -s HEAD:.mailmap) -ge 2048 &&
	cgitrc_repo mappedrc mapped &&
	cgit_ok mappedrc "url=mapped/log/" >tmp &&
	test_grep "<td class=.col-author.>New Name</td>" tmp &&
	test_grep ! -e "File Name" -e "Blob Name" tmp &&
	cgitrc_repo mappedcaprc mapped max-blob-size=1 &&
	cgit_ok mappedcaprc "url=mapped/log/" >tmp &&
	test_grep "<td class=.col-author.>Old Name</td>" tmp &&
	test_grep ! "New Name" tmp
'

test_done