index : cgit

#!/bin/sh

# Checks about-render.lua, the shipped about-filter. The unit checks drive
# the script under every suitable standalone Lua through the harness in
# extensions/, once with lpeg wherever that interpreter has it and once with
# lpeg forced away so the plain text fallback is proven everywhere. A
# repository with a markdown readme is then rendered through cgit itself,
# with lpeg wherever a probe finds it in the Lua inside the binary, and with
# every Lua module kept off the search path, which gives the fallback on any
# machine.

test_description='Check the shipped about-render extension'
CGIT_TEST_NO_CREATE_REPOS=YesPlease
. ./setup.sh
. "$TEST_OUTPUT_DIRECTORY/extensions/lib.sh"

for lua in ${interpreters:-lua}
do
	lua_module_prereq "$lua" lpeg
	test_expect_success "STANDALONE_LUA,$lua_prereq" "unit checks under $(lua_version "$lua")" '
		"$lua" "$EXT_TEST_DIRECTORY/test-about-render.lua" "$EXTENSIONS_DIRECTORY/about-render.lua" lpeg
	'

	test_expect_success STANDALONE_LUA "fallback checks without lpeg under $(lua_version "$lua")" '
		"$lua" "$EXT_TEST_DIRECTORY/test-about-render.lua" "$EXTENSIONS_DIRECTORY/about-render.lua" nolpeg
	'
done

test_expect_success 'create a repository with a markdown readme' '
	test_create_repo repos/md &&
	(
		cd repos/md &&
		cat >README.md <<-\EOF &&
		# The Title

		A **bold** claim and a <script>alert(1)</script> attempt.

		See the [roadmap](ROADMAP.md#plan).
		EOF
		cat >tool.1 <<-\EOF &&
		.TH TOOL 1
		.SH NAME
		tool \- does one thing \(em well
		.SH OPTIONS
		.TP
		.B \-v
		Be \fIverbose\fR.
		.nf
		tool \-v <file>
		.fi
		EOF
		echo "Plain <b>notes</b> & more" >NOTES &&
		git add README.md tool.1 NOTES &&
		git commit -m "add readme" &&
		git branch next
	)
'

test_expect_success 'point cgit at it through the about filter' '
	cat >cgitrc <<-EOF
	virtual-root=/
	cache-size=0
	repo.url=md
	repo.path=$PWD/repos/md/.git
	repo.readme=:README.md
	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
	repo.url=man
	repo.path=$PWD/repos/md/.git
	repo.readme=:tool.1
	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
	repo.url=txt
	repo.path=$PWD/repos/md/.git
	repo.readme=:NOTES
	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
	repo.url=noreadme
	repo.path=$PWD/repos/md/.git
	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
	EOF
'

if cgit_lua_probe "$PWD/repos/md/.git" lpeg
then
	test_set_prereq CGIT_LUA_LPEG
fi

test_expect_success CGIT_LUA_LPEG 'the about page renders the markdown' '
	cgit_ok_url "md/about/" >tmp &&
	test_grep "<h1 id=.the-title.>The Title</h1>" tmp &&
	test_grep "<strong>bold</strong>" tmp
'

test_expect_success CGIT_LUA_LPEG 'readme markup reaches the page escaped' '
	cgit_ok_url "md/about/" >tmp &&
	test_grep "&lt;script&gt;alert(1)&lt;/script&gt;" tmp &&
	test_grep ! "<script>alert(1)" tmp
'

test_expect_success CGIT_LUA_LPEG 'a relative link leads into the tree' '
	cgit_ok_url "md/about/" >tmp &&
	test_grep "<a href=./md/tree/ROADMAP.md#plan.>roadmap</a>" tmp
'

test_expect_success CGIT_LUA_LPEG 'the link stays on the branch shown' '
	cgit_ok_url "md/about/&h=next" >tmp &&
	test_grep "<a href=./md/tree/ROADMAP.md?h=next#plan.>roadmap</a>" tmp
'

test_expect_success CGIT_LUA_LPEG 'the about page renders a man page' '
	cgit_ok_url "man/about/" >tmp &&
	test_grep "<div class=.markdown.><h2 id=.name.>NAME</h2>" tmp &&
	test_grep "tool - does one thing — well" tmp &&
	test_grep "<strong>-v</strong><br>" tmp &&
	test_grep "<pre><code>tool -v &lt;file&gt;" tmp &&
	test_grep ! "\\\\f" tmp
'

test_expect_success CGIT_LUA_LPEG 'the about page shows plain text as it is' '
	cgit_ok_url "txt/about/" >tmp &&
	test_grep "<pre class=.plaintext.>Plain &lt;b&gt;notes&lt;/b&gt; &amp; more" tmp
'

# The filter makes no about page of its own, so a repository without a
# readme line sends its about page on to the summary.
test_expect_success CGIT_LUA 'the about page wants a readme line, even with the filter' '
	cgit_url "noreadme/about/" >tmp &&
	test_grep "^Status: 302" tmp &&
	test_grep "^Location: /noreadme/$" tmp
'

# The site readme has no tree behind it, which leaves the scheme check as
# the only guard on its links.
test_expect_success CGIT_LUA_LPEG 'the site readme turns no unsafe link into one' '
	cat >root.md <<-\EOF &&
	# Site

	A [bad](javascript:alert%281%29) link and a [good](https://example.com/) one.
	EOF
	cat >rootrc <<-EOF &&
	virtual-root=/
	cache-size=0
	root-readme=$PWD/root.md
	about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
	EOF
	cgit_ok rootrc "p=about" >tmp &&
	test_grep "<h1 id=.site.>Site</h1>" tmp &&
	test_grep "<a href=.https://example.com/.>good</a>" tmp &&
	test_grep "A bad link" tmp &&
	test_grep ! "javascript:" tmp
'

test_expect_success CGIT_LUA 'without lpeg every readme is served escaped' '
	echo "[cgit] Unable to load lpeg, so markdown and man pages show as plain text" >expect &&
	without_lua_modules cgit_url "md/about/" >tmp 2>err &&
	test_cmp expect err &&
	test_grep "^Status: 200" tmp &&
	test_grep "</html>" tmp &&
	test_grep "<pre class=.plaintext.># The Title" tmp &&
	test_grep "&lt;script&gt;alert(1)&lt;/script&gt;" tmp &&
	test_grep ! "<script>alert(1)" tmp &&
	without_lua_modules cgit_url "man/about/" >tmp 2>err &&
	test_cmp expect err &&
	test_grep "<pre class=.plaintext.>\.TH TOOL 1" tmp &&
	test_grep -F ".SH NAME" tmp &&
	without_lua_modules cgit_url "txt/about/" >tmp 2>err &&
	test_cmp expect err &&
	test_grep "<pre class=.plaintext.>Plain &lt;b&gt;notes&lt;/b&gt; &amp; more" tmp
'

test_done