index : cgit

#!/bin/sh

# Regression tests from the audits of September and October 2026. Each case
# is a config, repository or request that used to crash cgit, end it inside
# git, or hand a visitor something other than what was asked for.

test_description='Check the audit regressions'
. ./setup.sh

test_expect_success 'set up a repository and a config to vary' '
	mkrepo repos/rob 3 &&
	sha=$(git -C repos/rob rev-parse HEAD~1) &&
	cgitrc_repo robrc rob snapshots=tar.gz
'

test_expect_success 'a repository without a path answers 404' '
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "repo.url=nopath" &&
		echo "repo.url=emptypath" &&
		echo "repo.path="
	} >nopathrc &&
	for r in nopath emptypath
	do
		cgit_rc nopathrc "url=$r/log/" >tmp &&
		grep "^Status: 404 Not Found" tmp &&
		grep "Failed to open $r: Not a valid git repository" tmp || return 1
	done
'

# The index dates a repository from files under its path, and one without a
# path has none, whatever sits in the working directory.
test_expect_success 'a repository without a path has no age on the index' '
	mkdir -p "(null)/refs/heads" &&
	>"(null)/refs/heads/master" &&
	cgit_rc nopathrc "url=" >tmp &&
	grep "</html>" tmp &&
	! grep "<time " tmp
'

test_expect_success 'a repository with an empty url is skipped with a warning' '
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "repo.url=" &&
		echo "repo.path=$PWD/repos/rob/.git" &&
		echo "repo.desc=nourl" &&
		echo "repo.url=rob" &&
		echo "repo.path=$PWD/repos/rob/.git"
	} >nourlrc &&
	cgit_rc nourlrc "url=rob/" >tmp 2>err &&
	grep "^Status: 200" tmp &&
	grep "Ignoring repository with an empty url" err &&
	cgit_rc nourlrc "url=" >tmp &&
	! grep nourl tmp &&
	cgit_rc nourlrc "r=" >tmp &&
	! grep nourl tmp
'

test_expect_success 'a scan path that is itself a repository is named after it' '
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "remove-suffix=1" &&
		echo "scan-path=$PWD/repos/rob"
	} >rootrc &&
	cgit_rc rootrc "url=" >tmp &&
	grep "toplevel-repo.><a href=./rob/.>rob</a>" tmp
'

test_expect_success 'a repo key after scan-path is reported instead of applied' '
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "repo.url=first" &&
		echo "repo.path=$PWD/repos/rob/.git" &&
		echo "scan-path=$PWD/repos" &&
		echo "repo.desc=misplaced"
	} >stalerc &&
	cgit_rc stalerc "url=" >tmp 2>err &&
	! grep "misplaced" tmp &&
	grep "Ignoring repo.desc before any repo.url" err
'

test_expect_success 'a valueless or broken git config in a scanned repository is skipped' '
	git clone -q --bare repos/rob/.git scan/a.git &&
	printf "[cgit]\n\thide\n[cgit\n" >>scan/a.git/config &&
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "enable-git-config=1" &&
		echo "scan-path=$PWD/scan"
	} >gitcfgrc &&
	cgit_rc gitcfgrc "url=" >tmp 2>err &&
	grep "toplevel-repo.><a href=./a.git/.>" tmp &&
	grep "Ignoring unreadable config in $PWD/scan/a.git/config" err
'

# A repository's own cgitrc belongs to whoever can push to it, and each value
# below would reach the page once trusted. clone-url is even expanded from
# the request's environment, a visitor's cookie among it, into a page the
# cache then serves to others.
test_expect_success 'set up a scanned repository setting every key that waits on trust' '
	git clone -q --bare repos/rob/.git scan/b.git &&
	mkrepo scankeys/k 1 &&
	sub=$(git -C scankeys/k rev-parse HEAD) &&
	git -C scankeys/k update-index --add --cacheinfo 160000,$sub,sub &&
	git -C scankeys/k update-index --add --cacheinfo 160000,$sub,other &&
	git -C scankeys/k commit -q -m gitlinks &&
	write_script evil-filter.sh <<-\EOF &&
	echo "evil filter"
	cat
	EOF
	cat >scankeys/k/.git/cgitrc <<-EOF &&
	desc=from the repo
	readme=master:file-1
	about-filter=exec:$PWD/evil-filter.sh
	head-content=<script>alert(1)</script>
	logo=/evil/logo.png
	logo-link=https://evil.example/logo-link
	clone-url=https://evil.example/clone
	module-link=https://evil.example/module/%s
	module-link.sub=https://evil.example/path/%s
	EOF
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "scan-path=$PWD/scankeys"
	} >scankeysrc &&
	{
		echo "trust-scan-config=1" &&
		cat scankeysrc
	} >scankeystrustrc
'

test_expect_success 'only descriptive keys are taken from a scanned repository' '
	for page in about/ "" tree/
	do
		cgit_rc scankeysrc "url=k/$page" >tmp 2>err &&
		test_grep "^Status: 200" tmp &&
		test_grep "<p class=.sub desc.>from the repo</p>" tmp &&
		test_grep ! "evil" tmp &&
		test_grep ! "alert(" tmp || return 1
	done &&
	for key in about-filter head-content logo logo-link clone-url module-link module-link.sub
	do
		test_grep "Ignoring $key in $PWD/scankeys/k/.git/: trust-scan-config is not set" err || return 1
	done &&
	cgit_rc scankeysrc "url=k/about/" >tmp &&
	test_grep "<pre class=.plaintext.>1$" tmp
'

test_expect_success 'with trust-scan-config the same keys apply' '
	sub=$(git -C scankeys/k rev-parse HEAD~1) &&
	cgit_ok scankeystrustrc "url=k/about/" >tmp &&
	test_grep "^<script>alert(1)</script></head>$" tmp &&
	test_grep "<a class=.logo. href=.https://evil.example/logo-link.><img src=./evil/logo.png." tmp &&
	test_grep "<div id=.about.>evil filter$" tmp &&
	cgit_ok scankeystrustrc "url=k/" >tmp &&
	test_grep "https://evil.example/clone" tmp &&
	cgit_ok scankeystrustrc "url=k/tree/" >tmp &&
	test_grep "href=.https://evil.example/path/$sub.>sub</a>" tmp &&
	test_grep "href=.https://evil.example/module/other.>other</a>" tmp
'

# A path on the server waits on trust, and so does a readme ending in a
# colon, which names no ref and is read as a path too.
test_expect_success 'a filesystem readme from a scanned repository is refused' '
	echo "outside the repository" >outside &&
	echo "outside the repository" >"scan/outside:" &&
	{
		echo "trust-scan-config=1" &&
		cat gitcfgrc
	} >gitcfgtrustrc &&
	for readme in "$PWD/outside" ../outside:
	do
		echo "readme=$readme" >scan/b.git/cgitrc &&
		cgit_rc gitcfgrc "url=b.git/about/" >tmp 2>err &&
		test_grep "^Status: 302" tmp &&
		test_grep "Ignoring readme in $PWD/scan/b.git/: trust-scan-config is not set" err &&
		cgit_rc gitcfgtrustrc "url=b.git/about/" >tmp &&
		test_grep "^Status: 200" tmp &&
		test_grep "outside the repository" tmp || return 1
	done
'

# The readme list is read as a page is served rather than copied at the
# scan-path line, so a readme set after the scan still applies.
test_expect_success 'a readme set after scan-path reaches a scanned repository' '
	rm scan/b.git/cgitrc &&
	cat gitcfgrc >laterrc &&
	echo "readme=master:file-1" >>laterrc &&
	cgit_rc laterrc "url=b.git/about/" >tmp &&
	grep "<pre class=.plaintext.>1$" tmp
'

# A repository served as html runs its pages on the site's own origin, so
# the switch waits on trust like the keys that place markup. The warning has
# to name the repository, which it did not for a key read from git config.
test_expect_success 'html serving from a scanned repository waits on trust' '
	(
		cd repos/rob &&
		printf "<p>page</p>\n" >page.html &&
		git add page.html &&
		git commit -m html
	) &&
	mkdir -p scan2 &&
	git clone -q --bare repos/rob/.git scan2/c.git &&
	git -C scan2/c.git config cgit.enable-html-serving 1 &&
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "enable-git-config=1" &&
		echo "mimetype.html=text/html" &&
		echo "scan-path=$PWD/scan2"
	} >htmlrc &&
	cgit_rc htmlrc "url=c.git/plain/page.html" >tmp 2>err &&
	grep "^Content-Type: text/plain" tmp &&
	grep "^X-Content-Type-Options: nosniff" tmp &&
	grep "Ignoring enable-html-serving in $PWD/scan2/c.git/: trust-scan-config is not set" err
'

test_expect_success 'with trust-scan-config the same repository serves html' '
	{
		echo "trust-scan-config=1" &&
		cat htmlrc
	} >htmltrustrc &&
	cgit_rc htmltrustrc "url=c.git/plain/page.html" >tmp &&
	grep "^Content-Type: text/html" tmp &&
	! grep "^X-Content-Type-Options" tmp
'

test_expect_success SYMLINKS 'a symlink cycle under the scan path is entered once' '
	ln -s . scan/loop &&
	cgit_rc gitcfgrc "url=" >tmp &&
	test $(grep -c "toplevel-repo" tmp) = 2
'

test_expect_success 'a bare query parameter does not swallow the next one' '
	cgit_rc robrc "url=rob/commit/&x&id=$sha" >tmp &&
	grep "<div class=.commit-subject.>commit 2" tmp
'

# Whether cgit first sees the filter's exit status or its closed pipe
# depends on which side runs first, so either message will do.
test_expect_success 'a filter that cannot run answers one error page' '
	{
		echo "commit-filter=exec:$PWD/no/such/filter" &&
		cat robrc
	} >badfilterrc &&
	cgit_rc badfilterrc "url=rob/commit/" >tmp 2>err &&
	test $(grep -c "^Status:" tmp) = 1 &&
	grep "Unable to complete the request" tmp &&
	grep -e "Unable to run filter $PWD/no/such/filter" -e "Unable to write the page" err &&
	grep "Unable to exec filter" err
'

# The filter may exit before or after cgit writes to it, so the page either
# completes or ends where the write failed. Either way cgit answers once and
# exits cleanly rather than dying of SIGPIPE. The file outgrows the pipe, so
# the write has to block and then fail however the two sides are scheduled.
test_expect_success 'a filter that exits without reading does not end cgit' '
	mkrepo repos/quit 1 &&
	test_seq 20000 >repos/quit/big.txt &&
	git -C repos/quit add big.txt &&
	git -C repos/quit commit -q -m big &&
	cgitrc_repo quitrc quit source-filter=exec:true &&
	cgit_rc quitrc "url=quit/tree/big.txt" >tmp 2>err &&
	test $(grep -c "^Status:" tmp) = 1 &&
	test_grep "<div class=.blob-header.>blob: " tmp
'

test_expect_success 'a commit encoding header is read without its newline' '
	(
		cd repos/rob &&
		echo more >file-1 &&
		git add file-1 &&
		git -c i18n.commitEncoding=ISO-8859-1 commit -m "$(printf "caf\351")"
	) &&
	cgit_rc robrc "url=rob/commit/" >tmp &&
	grep "<div class=.commit-subject.>caf$(printf "\303\251")<" tmp
'

# The about page shows the readme alone and its links lead into the tree,
# so a path below it names nothing, the site about page included.
test_expect_success 'a path below the about page answers 404' '
	(
		cd repos/rob &&
		git update-index --add --cacheinfo 160000,$sha,sub &&
		git commit -m gitlink
	) &&
	{
		echo "mimetype.png=image/png" &&
		cat robrc &&
		echo "repo.readme=master:file-1"
	} >aboutrc &&
	for path in sub sub/ missing.png file-1 ../robrc
	do
		cgit_rc aboutrc "url=rob/about/$path" >tmp 2>err &&
		grep "^Status: 404" tmp &&
		grep "^Content-Type: text/html" tmp &&
		! grep fatal err || return 1
	done &&
	cgit_rc aboutrc "p=about&path=x" >tmp &&
	grep "^Status: 404" tmp
'

# The stem becomes the leading directory of every member of the archive, so
# a name holding a slash is refused even where it spells a ref. Such a ref
# is linked under a dashed name instead.
test_expect_success 'a snapshot name holding a slash is refused' '
	git -C repos/rob tag rel/1 &&
	test_when_finished "git -C repos/rob tag -d rel/1" &&
	for name in rel/1 :/../../..
	do
		cgit_rc robrc "url=rob/snapshot/$name.tar.gz" >tmp &&
		test_grep "^Status: 404" tmp || return 1
	done &&
	cgit_ok robrc "url=rob/snapshot/rob-master.tar.gz" >tmp
'

# Only a ref is worked back from a file name, since the wider revision syntax
# can walk the whole history for a match. The name holds no slash, so it
# reaches that check rather than the one above.
test_expect_success 'a snapshot name in revision syntax is refused' '
	cgit_rc robrc "url=rob/snapshot/master~1.tar.gz" >tmp &&
	test_grep "^Status: 404" tmp &&
	cgit_ok robrc "url=rob/snapshot/master.tar.gz" >tmp
'

test_expect_success 'a path opening with a colon is refused on the log and patch pages' '
	cgit_rc robrc "url=rob/log/:%25x" >tmp &&
	grep "^Status: 400" tmp &&
	cgit_rc robrc "url=rob/patch/:%25x" >tmp &&
	grep "^Status: 400" tmp &&
	test $(grep -c "^Status:" tmp) = 1
'

test_expect_success 'a revision spelled like an option is refused' '
	git -C repos/rob update-ref refs/heads/--stdin HEAD &&
	cgit_rc robrc "url=rob/log/&h=--stdin" >tmp &&
	grep "^Status: 404" tmp &&
	cgit_rc robrc "url=rob/blame/file-1&id=--stdin" >tmp &&
	grep "^Status: 400" tmp &&
	cgit_rc robrc "url=rob/atom/&h=--stdin" >tmp &&
	grep "^Status: 404" tmp
'

test_expect_success 'the blob page reads a file through an annotated tag' '
	git -C repos/rob -c tag.gpgsign=false tag -a -m note ann HEAD &&
	cgit_rc robrc "url=rob/blob/&h=ann&path=file-1" >tmp &&
	strip_headers <tmp >body &&
	printf "more\n" >want &&
	test_cmp want body
'

# The plain page walks a path out of whatever commit the id names, and the
# blob page used to answer such a request with the raw commit object.
test_expect_success 'the blob page walks a path out of the commit or tag the id names' '
	tip=$(git -C repos/rob rev-parse HEAD) &&
	cgit_rc robrc "url=rob/blob/file-1&id=$tip" >tmp &&
	strip_headers <tmp >body &&
	test_cmp want body &&
	tag=$(git -C repos/rob rev-parse ann) &&
	cgit_rc robrc "url=rob/blob/file-1&id=$tag" >tmp &&
	strip_headers <tmp >body &&
	test_cmp want body &&
	cgit_rc robrc "url=rob/blob/missing&id=$tip" >tmp &&
	grep "^Status: 404" tmp
'

test_expect_success 'the commit page shows a message whole when text follows its trailers' '
	(
		cd repos/rob &&
		echo again >file-1 &&
		git add file-1 &&
		git commit -F - <<-\EOF
		Subject

		Body text.

		Signed-off-by: A U Thor <author@example.com>

		Conflicts:
			file-1
		EOF
	) &&
	{
		echo "enable-commit-trailers=1" &&
		cat robrc
	} >trailrc &&
	cgit_rc trailrc "url=rob/commit/" >tmp &&
	! grep "commit-trailers" tmp &&
	grep "Conflicts:" tmp
'

test_expect_success 'a revision expression that walks the history is refused' '
	cgit_rc robrc "url=rob/log/&h=:/zzzz" >tmp &&
	grep "^Status: 404" tmp &&
	cgit_rc robrc "url=rob/commit/&id=HEAD^{/zzzz}" >tmp &&
	grep "^Status: 400" tmp &&
	cgit_rc robrc "url=rob/log/&qt=range&q=:/zzzz" >tmp &&
	grep "^Status: 400" tmp &&
	cgit_rc robrc "url=rob/log/&qt=range&q=master~1..master" >tmp &&
	grep "^Status: 400" tmp &&
	cgit_rc robrc "url=rob/log/&qt=range&q=$sha..master" >tmp &&
	grep "^Status: 200" tmp
'

test_expect_success 'a commit with a broken tree line does not crash the blob page' '
	git clone -q repos/rob broken &&
	(
		cd broken &&
		bad=$(git cat-file commit HEAD | sed "s/^tree .*/tree not-a-hash/" |
			git hash-object -t commit -w --stdin --literally) &&
		echo $bad >.git/refs/heads/bad
	) &&
	cgitrc_repo brokenrc broken "repo.path=$PWD/broken/.git" repo.readme=:file-1 &&
	cgit_rc brokenrc "url=broken/blob/&h=bad&path=file-1" >tmp &&
	grep "^Status: 404" tmp
'

test_expect_success 'a die inside git answers one 500 page and logs the reason' '
	printf "[core\n" >>broken/.git/config &&
	cgit_rc brokenrc "url=broken/log/" >tmp 2>err &&
	grep "^Status: 500" tmp &&
	test $(grep -c "^Status:" tmp) = 1 &&
	grep "bad config line" err &&
	! grep "bad config line" tmp
'

test_expect_success 'a history with a missing parent renders up to the gap' '
	git clone -q repos/rob gap &&
	older=$(git -C gap rev-parse HEAD~3) &&
	parent=$(git -C gap rev-parse HEAD~2) &&
	rm gap/.git/objects/$(echo $parent | cut -c1-2)/$(echo $parent | cut -c3-) &&
	cgitrc_repo gaprc gap "repo.path=$PWD/gap/.git" &&
	cgit_rc gaprc "url=gap/log/" >tmp 2>err &&
	test $(grep -c "^Status:" tmp) = 1 &&
	grep "Unable to complete the request" tmp &&
	grep "Failed to traverse parents" err &&
	cgit_rc gaprc "url=gap/patch/&id2=$older" >tmp &&
	test $(grep -c "^Status:" tmp) = 1 &&
	grep "^Status: 500" tmp
'

# The commit page collects each file's diff body before printing it, so a
# die while one is collected has to reach the page rather than the body.
test_expect_success 'a corrupt blob in a collected diff answers the error' '
	git init -q corrupt &&
	(
		cd corrupt &&
		test_seq 2000 >f &&
		git add f &&
		git commit -q -m one &&
		test_seq 2000 | sed "s/^5/X/" >f &&
		git commit -q -a -m two &&
		blob=$(git rev-parse HEAD:f) &&
		obj=.git/objects/$(echo $blob | cut -c1-2)/$(echo $blob | cut -c3-) &&
		size=$(wc -c <$obj) &&
		chmod u+w $obj &&
		test_copy_bytes $((size / 2)) <$obj >half &&
		mv half $obj
	) &&
	cgitrc_repo corruptrc corrupt "repo.path=$PWD/corrupt/.git" &&
	cgit_rc corruptrc "url=corrupt/commit/" >tmp 2>err &&
	grep "is corrupt" err &&
	grep "Unable to complete the request" tmp
'

# Shells word the failed write differently, and dash names no broken pipe at
# all, so the test looks at whether the writer outlived the closed pipe. It
# puts out more than a pipe holds, so it meets the closed end whatever the
# timing, and it is a script of its own because a subshell of ksh stops at
# the failed write even with the signal ignored.
test_expect_success 'a filter pipeline sees the default SIGPIPE disposition' '
	write_script writer.sh <<-\EOF &&
	n=0
	while test $n -lt 20000
	do
		echo line
		n=$((n + 1))
	done
	echo outlived >"$PWD/outlived"
	EOF
	write_script pipe.sh <<-EOF &&
	"$PWD/writer.sh" | head -n 1
	EOF
	cgitrc_repo piperc rob "source-filter=exec:$PWD/pipe.sh" &&
	cgit_ok piperc "url=rob/tree/file-1" >tmp &&
	test_grep "<pre><code>line$" tmp &&
	test_path_is_missing outlived
'

test_expect_success 'the fallback branch skips a name spelled like an option' '
	git -C repos/rob update-ref refs/heads/-first HEAD &&
	git -C repos/rob symbolic-ref HEAD refs/heads/gone &&
	cgit_rc robrc "url=rob/" >tmp &&
	git -C repos/rob symbolic-ref HEAD refs/heads/master &&
	grep "^Status: 200" tmp
'

# Such a branch is refused as a head, so the switcher must not offer a
# choice that can only lead to an error page.
test_expect_success 'the branch switcher leaves out a name spelled like an option' '
	grep "<option value=.master." tmp &&
	! grep "<option value=.-first." tmp
'

test_expect_success 'a blank line in the mimetype file is skipped' '
	(
		cd repos/rob &&
		echo note >note.cgt &&
		git add note.cgt &&
		git commit -m note
	) &&
	printf "\n   \nimage/x-cgit cgt\n" >mime.types &&
	{
		echo "mimetype-file=$PWD/mime.types" &&
		cat robrc
	} >mimerc &&
	cgit_rc mimerc "url=rob/plain/note.cgt" >tmp &&
	grep "^Content-Type: image/x-cgit" tmp
'

test_expect_success 'an indented comment in the mimetype file is skipped' '
	printf "  # cgt used to be image/x-old\nimage/x-cgit cgt\n" >mime.types &&
	cgit_rc mimerc "url=rob/plain/note.cgt" >tmp &&
	grep "^Content-Type: image/x-cgit" tmp
'

test_expect_success 'a refs page named with an id is not cached for ever' '
	{
		echo "cache-size=10" &&
		echo "cache-root=$PWD/cache" &&
		echo "cache-static-ttl=-1" &&
		echo "cache-dynamic-ttl=0" &&
		echo "cache-summary-ttl=0" &&
		grep -v "^cache-size" robrc
	} >ttlrc &&
	full=$(git -C repos/rob rev-parse HEAD) &&
	cgit_rc ttlrc "url=rob/refs/&id=$full" >tmp &&
	git -C repos/rob tag later HEAD &&
	cgit_rc ttlrc "url=rob/refs/&id=$full" >tmp &&
	grep ">later<" tmp
'

test_expect_success 'the diff caps hold when the path names a directory' '
	(
		cd repos/rob &&
		mkdir -p dir &&
		for n in 1 2 3
		do
			echo $n >dir/f$n || return 1
		done &&
		git add dir &&
		git commit -m dir
	) &&
	{
		echo "max-diff-files=2" &&
		cat robrc
	} >caprc &&
	cgit_rc caprc "url=rob/diff/dir" >tmp &&
	grep "too large to be rendered inline" tmp &&
	cgit_rc caprc "url=rob/diff/dir/f1" >tmp &&
	! grep "too large to be rendered inline" tmp
'

test_expect_success 'a snapshot of a tag spelled like an option is archived' '
	git -C repos/rob update-ref refs/tags/-l HEAD &&
	cgit_rc robrc "url=rob/snapshot/-l.tar.gz" >tmp &&
	grep "^Status: 200" tmp &&
	strip_headers <tmp | gzip -dc | tar -tf - >list &&
	grep "file-1" list
'

test -n "$CGIT_VALGRIND" || test_set_prereq NO_VALGRIND

test_expect_success NO_VALGRIND 'a snapshot format whose compressor is missing answers 500' '
	{
		echo "snapshots=tar.xz" &&
		grep -v "^snapshots" robrc
	} >xzrc &&
	cgitbin=$(command -v cgit) &&
	mkdir -p nobin &&
	PATH="$PWD/nobin" CGIT_CONFIG="$PWD/xzrc" \
		QUERY_STRING="url=rob/snapshot/rob-master.tar.xz" $cgitbin >tmp &&
	grep "^Status: 500" tmp &&
	test $(grep -c "^Status:" tmp) = 1
'

test_expect_success 'a disk readme in the repository directory serves no sibling' '
	echo hello >repos/rob/.git/README &&
	{
		cat robrc &&
		echo "repo.readme=README"
	} >diskrc &&
	cgit_rc diskrc "url=rob/about/" >tmp &&
	grep "hello" tmp &&
	cgit_rc diskrc "url=rob/about/config" >tmp &&
	grep "^Status: 404" tmp &&
	! grep "repositoryformatversion" tmp
'

test_expect_success 'a tag pointing at a tag links the inner tag by id' '
	git -C repos/rob -c tag.gpgsign=false tag -a -m outer outer ann &&
	inner=$(git -C repos/rob rev-parse ann) &&
	cgit_rc robrc "url=rob/tag/&id=$inner" >tmp &&
	grep "^Status: 200" tmp &&
	grep "tagged object" tmp
'

test_expect_success 'the dumb transport serves an empty repository' '
	git init -q --bare empty.git &&
	cgitrc_repo emptyrc empty "repo.path=$PWD/empty.git" &&
	cgit_rc emptyrc "url=empty/info/refs" >tmp &&
	grep "^Status: 200" tmp &&
	grep "^Content-Type: text/plain" tmp &&
	cgit_rc emptyrc "url=empty/objects/info" >tmp &&
	grep "^Status: 404" tmp
'

# A pack is handed over as it sits on the disk, so the client can be told
# its size up front and compare what arrived against it.
test_expect_success 'the dumb transport sends a file with its size' '
	git -C repos/rob repack -q -d &&
	cgit_rc robrc "url=rob/objects/info/packs" >tmp &&
	pack=$(strip_headers <tmp | sed -n "s/^P //p" | head -1) &&
	test -n "$pack" &&
	cgit_rc robrc "url=rob/objects/pack/$pack" >tmp &&
	grep "^Status: 200" tmp &&
	size=$(wc -c <repos/rob/.git/objects/pack/$pack | tr -d " ") &&
	grep "^Content-Length: $size$" tmp &&
	strip_headers <tmp >body &&
	cmp body repos/rob/.git/objects/pack/$pack
'

# A reftable repository keeps only a placeholder in its HEAD file, so the
# branch a client is to check out has to come from the refs instead.
test_expect_success 'the dumb transport answers HEAD from the refs' '
	cgit_rc robrc "url=rob/HEAD" >tmp &&
	grep "^Status: 200" tmp &&
	strip_headers <tmp >head &&
	echo "ref: refs/heads/master" >expect &&
	test_cmp expect head &&
	git init -q --bare --ref-format=reftable -b trunk rt.git &&
	git -C repos/rob push -q "$PWD/rt.git" master:trunk &&
	cgitrc_repo rtrc rt "repo.path=$PWD/rt.git" &&
	cgit_rc rtrc "url=rt/HEAD" >tmp &&
	strip_headers <tmp >head &&
	echo "ref: refs/heads/trunk" >expect &&
	test_cmp expect head &&
	cgit_rc emptyrc "url=empty/HEAD" >tmp &&
	strip_headers <tmp >head &&
	echo "ref: refs/heads/master" >expect &&
	test_cmp expect head
'

test_expect_success 'a reftable repository shows its age on the index' '
	cgit_rc rtrc "url=" >tmp &&
	grep "<td class=.col-idle.><time " tmp
'

# A client that goes away mid-page leaves nobody to send an error page to,
# so the request ends quietly instead of dying twice into the log. The page
# has to outgrow the pipe for the write after the reader has gone to fail.
test_expect_success 'a client that disconnects ends the request quietly' '
	(
		cd repos/rob &&
		awk "BEGIN{for(i=0;i<20000;i++) print \"line \" i}" >long.txt &&
		git add long.txt &&
		git commit -m long
	) &&
	{ cgit_rc robrc "url=rob/tree/long.txt" 2>err; echo $? >status; } | head -c 1 >/dev/null &&
	test "$(cat status)" = 0 &&
	! grep -i "broken pipe" err &&
	! grep "die()" err
'

# A page an auth filter let a visitor see is theirs alone, so a cache
# shared with other visitors has to be told, while a site without a filter
# keeps its pages free of any such header.
test_expect_success 'pages behind an auth filter are marked private' '
	write_script letin.sh <<-\EOF &&
	exit 1
	EOF
	{
		echo "auth-filter=exec:$PWD/letin.sh" &&
		cat robrc
	} >letinrc &&
	cgit_rc letinrc "url=rob/log/" >tmp &&
	grep "^Status: 200" tmp &&
	grep "^Cache-Control: private$" tmp &&
	grep "^Vary: Cookie$" tmp &&
	cgit_rc robrc "url=rob/log/" >tmp &&
	! grep "^Cache-Control" tmp &&
	! grep "^Vary" tmp
'

# A repository without a readme sends its about page to the summary, and
# the branch asked for has to survive that hop.
test_expect_success 'the about redirect keeps the query string' '
	git -C repos/rob branch other HEAD &&
	cgit_rc robrc "url=rob/about&h=other&x=1" >tmp &&
	grep "^Status: 302" tmp &&
	grep "^Location: /rob/?h=other&x=1$" tmp &&
	cgit_rc aboutrc "url=rob/about&h=other" >tmp &&
	grep "^Status: 200" tmp
'

# A readme named without a branch is read from the head being browsed, and an
# annotated tag reaches its commit only through the tag object.
test_expect_success 'the readme follows an annotated tag as the head' '
	git -C repos/rob tag -a -m release v1 HEAD &&
	{
		cat robrc &&
		echo "repo.readme=:file-1"
	} >tagreadmerc &&
	cgit_rc tagreadmerc "url=rob/about/&h=v1" >tmp &&
	grep "^Status: 200" tmp &&
	cgit_rc tagreadmerc "url=rob/tree/&h=v1" >tmp &&
	grep ">about<" tmp
'

test_expect_success 'the about redirect encodes the repository url once' '
	cgit_url "foo%2Bbar/about/" >tmp &&
	grep "^Status: 302" tmp &&
	grep "^Location: /foo%2Bbar/$" tmp
'

test_expect_success 'a symlink whose target is a large blob is listed without it' '
	big=$(head -c 5000 /dev/zero | tr "\0" a | git -C repos/rob hash-object -w --stdin) &&
	(
		cd repos/rob &&
		git update-index --add --cacheinfo 120000,$big,biglink &&
		git commit -m biglink
	) &&
	cgit_rc robrc "url=rob/tree/" >tmp &&
	grep "biglink" tmp &&
	! grep "aaaaaaaaaa" tmp
'

test_expect_success 'a chain of single directories is followed a bounded number of levels' '
	(
		cd repos/rob &&
		deep=$(printf "d/%.0s" $(seq 1 40))leaf &&
		mkdir -p $(dirname $deep) &&
		echo x >$deep &&
		git add d &&
		git commit -m deep
	) &&
	cgit_rc robrc "url=rob/tree/" >tmp &&
	test $(grep -o "class=.ls-dir." tmp | wc -l) -le 17
'

# The line has to carry the read error rather than the flag ferror returns.
# A system may open a directory and fail the read, or refuse the open, so the
# same error text is expected from either path.
test_expect_success 'an unreadable project list is named with its error' '
	mkdir -p projdir &&
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "project-list=$PWD/projdir" &&
		echo "scan-path=$PWD/repos"
	} >projrc &&
	cgit_rc projrc "url=" >tmp 2>err &&
	grep "project list .*projdir: Is a directory" err
'

test_expect_success SANITY 'a scan entry that cannot be searched is named in full' '
	mkdir -p scanperm/locked &&
	test_when_finished "chmod 755 scanperm/locked" &&
	chmod 644 scanperm/locked &&
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "scan-path=$PWD/scanperm"
	} >scanpermrc &&
	cgit_rc scanpermrc "url=" >tmp 2>err &&
	grep "Unable to stat .*scanperm/locked/objects: Permission denied" err
'

# A readme past max-blob-size is never read, so the about page says why it
# has nothing to show.
test_expect_success 'a readme past max-blob-size is reported on the about page' '
	test_seq 1 1000 >repos/rob/big-readme &&
	git -C repos/rob add big-readme &&
	git -C repos/rob commit -q -m "big readme" &&
	{
		echo "max-blob-size=1" &&
		cat robrc &&
		echo "repo.readme=:big-readme"
	} >bigreadmerc &&
	cgit_rc bigreadmerc "url=rob/about/" >tmp &&
	grep "The readme is larger than max-blob-size (1 KB)" tmp
'

# The chrome names a pinned commit in the title, and on an error page the id
# that was just refused must not be looked up to get there, since the wider
# revision syntax walks the whole history for a match.
test_expect_success 'the error page does not resolve the id it refused' '
	cgit_rc robrc "url=rob/log/&id=$sha" >tmp &&
	grep "<title>.* @ " tmp &&
	cgit_rc robrc "url=rob/log/&id=%3A/commit" >tmp &&
	grep "^Status: 400" tmp &&
	! grep "<title>.* @ " tmp
'

# A pushed date or zone outside what git's date code accepts used to end the
# summary, refs and log pages inside git. Each is now shown as the epoch or
# as UTC, the way git's own log shows them.
test_expect_success 'odd dates and zones in pushed objects render' '
	test_create_repo repos/dates &&
	(
		cd repos/dates &&
		test_commit base &&
		c=$(git rev-parse HEAD) &&
		t=$(printf "object %s\\ntype commit\\ntag early\\ntagger E <e@x> 1 -0100\\n\\nearly\\n" $c |
			git hash-object -t tag -w --stdin) &&
		git update-ref refs/tags/early $t &&
		tree=$(git rev-parse HEAD^{tree}) &&
		far=$(printf "tree %s\\nauthor A <a@x> 9223372036854775808 +0000\\ncommitter A <a@x> 9223372036854775808 +0000\\n\\nfar\\n" $tree |
			git hash-object -t commit -w --literally --stdin) &&
		git update-ref refs/heads/far $far &&
		zone=$(printf "tree %s\\nauthor A <a@x> 1700000000 -2147483648\\ncommitter A <a@x> 1700000000 +99999999999\\n\\nzone\\n" $tree |
			git hash-object -t commit -w --literally --stdin) &&
		git update-ref refs/heads/zone $zone
	) &&
	cgitrc_repo datesrc dates &&
	for q in "url=dates/" "url=dates/refs/" "url=dates/tag/&h=early" \
		"url=dates/log/&h=far" "url=dates/commit/&h=far" "url=dates/commit/&h=zone" \
		"url=dates/atom/&h=far"
	do
		cgit_rc datesrc "$q" >tmp 2>err &&
		grep "^Status: 200" tmp &&
		! grep "Unable to complete" tmp &&
		! grep "Timestamp" err || return 1
	done &&
	cgit_rc datesrc "url=dates/commit/&h=far" >tmp &&
	grep "1970-01-01" tmp
'

# A notes ref a pusher pointed at something other than a tree made git die on
# loading it, which took every page of the repository down with it.
test_expect_success 'a notes ref that names no tree is passed over' '
	blob=$(echo not-a-tree | git -C repos/dates hash-object -w --stdin) &&
	git -C repos/dates update-ref refs/notes/commits $blob &&
	git -C repos/dates update-ref refs/notes/signatures/tar $blob &&
	{
		echo "snapshots=tar" &&
		cat datesrc
	} >notesrc &&
	for q in "url=dates/" "url=dates/log/" "url=dates/refs/" "url=dates/tree/" \
		"url=dates/snapshot/dates-base.tar.asc"
	do
		cgit_rc notesrc "$q" >tmp 2>err &&
		! grep "Unable to complete" tmp &&
		! grep "notes tree" err || return 1
	done &&
	grep "^Status: 404" tmp
'

# A scanned repository names its own default branch, which the index stats
# below the repository to date it, so the name is held to what a ref may be.
test_expect_success 'a scanned defbranch cannot name a path outside the repository' '
	mkdir -p secret &&
	touch -t 200001010000 secret/file &&
	echo "defbranch=../../../../secret/file" >scan/b.git/cgitrc &&
	cgit_rc gitcfgrc "url=" >tmp &&
	grep ">b.git</a>" tmp &&
	! grep "data-ut=.946" tmp
'

# HEAD is a file the repository's owner writes as well, and the index stats
# the branch it names to date the repository.
test_expect_success 'a crafted HEAD cannot date a repository from outside it' '
	mkdir -p aimed &&
	touch -t 200001010000 aimed/file &&
	git init -q --bare headscan/h.git &&
	echo "ref: refs/heads/../../../../aimed/file" >headscan/h.git/HEAD &&
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "scan-path=$PWD/headscan"
	} >headrc &&
	cgit_rc headrc "url=" >tmp &&
	test_grep "^Status: 200" tmp &&
	test_grep ">h.git</a>" tmp &&
	test_grep ! "data-ut=.946" tmp
'

# Blame works on text alone, so a binary file is offered no blame link from
# its own page, and a request that names one anyway is told why.
test_expect_success 'blame turns away a binary file' '
	mkrepo repos/binblame 1 &&
	(
		cd repos/binblame &&
		printf "a\000b\n" >bin.dat &&
		git add bin.dat &&
		git commit -q -m binary
	) &&
	cgitrc_repo binblamerc binblame repo.enable-blame=1 &&
	cgit_ok binblamerc "url=binblame/blame/bin.dat" >tmp &&
	test_grep "<div class=.error.>Blob is binary</div>" tmp &&
	test_grep ! "<table class=.blame blob.>" tmp &&
	cgit_ok binblamerc "url=binblame/tree/bin.dat" >tmp &&
	test_grep "<div class=.blob-header.>blob: " tmp &&
	test_grep ! "href=./binblame/blame/" tmp &&
	cgit_ok binblamerc "url=binblame/tree/file-1" >tmp &&
	test_grep "(<a href=./binblame/blame/file-1.>blame</a>)" tmp
'

# A scanned repository may set its description, owner and section without
# trust, so markup in them has to land escaped on the index and in the meta
# description of its own pages.
test_expect_success 'descriptive values from a scanned repository are escaped' '
	git clone -q --bare repos/rob/.git descscan/d.git &&
	cat >descscan/d.git/cgitrc <<-\EOF &&
	desc=desc <x> & "q" '\''s
	owner=owner <x> & "q" '\''s
	section=section <x> & "q" '\''s
	EOF
	{
		echo "virtual-root=/" &&
		echo "cache-size=0" &&
		echo "enable-index-owner=1" &&
		echo "scan-path=$PWD/descscan"
	} >descrc &&
	cgit_ok descrc "url=" >tmp &&
	test_grep "<a href=./d.git/.>desc &lt;x&gt; &amp; \"q\" .s</a>" tmp &&
	test_grep "<a href=./?q=owner+%3Cx%3E+%26+%22q%22+%27s.>owner &lt;x&gt; &amp; \"q\" .s</a>" tmp &&
	test_grep "class=.reposection.>section &lt;x&gt; &amp; \"q\" .s</td>" tmp &&
	test_grep ! "<x>" tmp &&
	cgit_ok descrc "url=d.git/" >tmp &&
	test_grep "<meta name=.description. content=.desc &lt;x&gt; &amp; &quot;q&quot; &#x27;s.>" tmp &&
	test_grep ! "<x>" tmp
'

# A repository's own config cannot point the mailmap reader at a file on the
# server or another blob, and git reads the mailmap whole, so one past
# max-blob-size is passed over like any other large blob.
test_expect_success 'only a .mailmap at HEAD within max-blob-size is applied' '
	test_create_repo repos/mapped &&
	(
		cd repos/mapped &&
		echo content >file &&
		git add file &&
		GIT_AUTHOR_NAME="Old Name" GIT_AUTHOR_EMAIL=old@example.com \
			git commit -q -m first &&
		echo "New Name <new@example.com> <old@example.com>" >.mailmap &&
		test_seq -f "# padding line %d" 1 200 >>.mailmap &&
		echo "Blob Name <blob@example.com> <old@example.com>" >other-map &&
		git add .mailmap other-map &&
		git commit -q -m "add the mailmaps" &&
		echo "File Name <file@example.com> <old@example.com>" >../map-on-disk &&
		git config mailmap.file "$PWD/../map-on-disk" &&
		git config mailmap.blob HEAD:other-map
	) &&
	test $(git -C repos/mapped cat-file -s HEAD:.mailmap) -ge 2048 &&
	cgitrc_repo mappedrc mapped &&
	cgit_ok mappedrc "url=mapped/log/" >tmp &&
	test_grep "<td class=.col-author.>New Name</td>" tmp &&
	test_grep ! -e "File Name" -e "Blob Name" tmp &&
	cgitrc_repo mappedcaprc mapped max-blob-size=1 &&
	cgit_ok mappedcaprc "url=mapped/log/" >tmp &&
	test_grep "<td class=.col-author.>Old Name</td>" tmp &&
	test_grep ! "New Name" tmp
'

test_done