diff options
| author |  Junio C Hamano <gitster@pobox.com> | 2019-12-01 09:04:41 -0800 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2019-12-01 09:04:41 -0800 |
| commit | 6c630f237e72d3adef8a089bdf984ec1e47b2708 (patch) | |
| tree | 876c2e2699c813cc93a9a967b154887bf21402e7 /t | |
| parent | Merge branch 'ar/install-doc-update-cmds-needing-the-shell' (diff) | |
| parent | gitweb: escape URLs generated by href() (diff) | |
| download | tgif-6c630f237e72d3adef8a089bdf984ec1e47b2708.tar.xz | |
Merge branch 'jk/gitweb-anti-xss'
Some codepaths in "gitweb" that forgot to escape URLs generated
based on end-user input have been corrected.
* jk/gitweb-anti-xss:
gitweb: escape URLs generated by href()
t/gitweb-lib.sh: set $REQUEST_URI
t/gitweb-lib.sh: drop confusing quotes
t9502: pass along all arguments in xss helper
Diffstat (limited to 't')
| -rw-r--r-- | t/gitweb-lib.sh | 7 | ||||
| -rwxr-xr-x | t/t9502-gitweb-standalone-parse-output.sh | 7 |
2 files changed, 8 insertions, 6 deletions
diff --git a/t/gitweb-lib.sh b/t/gitweb-lib.sh index 006d2a8152..1f32ca66ea 100644 --- a/t/gitweb-lib.sh +++ b/t/gitweb-lib.sh @@ -58,10 +58,11 @@ gitweb_run () { GATEWAY_INTERFACE='CGI/1.1' HTTP_ACCEPT='*/*' REQUEST_METHOD='GET' - QUERY_STRING=""$1"" - PATH_INFO=""$2"" + QUERY_STRING=$1 + PATH_INFO=$2 + REQUEST_URI=/gitweb.cgi$PATH_INFO export GATEWAY_INTERFACE HTTP_ACCEPT REQUEST_METHOD \ - QUERY_STRING PATH_INFO + QUERY_STRING PATH_INFO REQUEST_URI GITWEB_CONFIG=$(pwd)/gitweb_config.perl export GITWEB_CONFIG diff --git a/t/t9502-gitweb-standalone-parse-output.sh b/t/t9502-gitweb-standalone-parse-output.sh index 0796a438bc..e38cbc97d3 100755 --- a/t/t9502-gitweb-standalone-parse-output.sh +++ b/t/t9502-gitweb-standalone-parse-output.sh @@ -188,8 +188,8 @@ test_expect_success 'forks: project_index lists all projects (incl. forks)' ' ' xss() { - echo >&2 "Checking $1..." && - gitweb_run "$1" && + echo >&2 "Checking $*..." && + gitweb_run "$@" && if grep "$TAG" gitweb.body; then echo >&2 "xss: $TAG should have been quoted in output" return 1 @@ -200,7 +200,8 @@ xss() { test_expect_success 'xss checks' ' TAG="<magic-xss-tag>" && xss "a=rss&p=$TAG" && - xss "a=rss&p=foo.git&f=$TAG" + xss "a=rss&p=foo.git&f=$TAG" && + xss "" "$TAG+" ' test_done |