git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH 1/4] t9502: pass along all arguments in xss helper

From
Jeff King <peff@peff.net>
Date
Nov 15, 2019, 09:05 UTC
Message-ID
<20191115090556.GA21987@sigill.intra.peff.net>
In-Reply-To
<20191115090545.GA30971@sigill.intra.peff.net>

This function is just a thin wrapper around gitweb_run(), which takes multiple arguments. But we only pass along "$1". Let's pass everything we get, which will let a future patch add an XSS test that affects PATH_INFO (which gitweb_run() takes as $2).

Signed-off-by: Jeff King <peff@peff.net>
---
 t/t9502-gitweb-standalone-parse-output.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/t/t9502-gitweb-standalone-parse-output.sh b/t/t9502-gitweb-standalone-parse-output.sh
index 0796a438bc..1b04c29037 100755
--- a/t/t9502-gitweb-standalone-parse-output.sh
+++ b/t/t9502-gitweb-standalone-parse-output.sh
@@ -188,8 +188,8 @@ test_expect_success 'forks: project_index lists all projects (incl. forks)' '
 '
 
 xss() {
-	echo >&2 "Checking $1..." &&
-	gitweb_run "$1" &&
+	echo >&2 "Checking $*..." &&
+	gitweb_run "$@" &&
 	if grep "$TAG" gitweb.body; then
 		echo >&2 "xss: $TAG should have been quoted in output"
 		return 1
-- 
2.24.0.739.gb5632e4929
Previous: Jeff KingNext: Jeff King
Message 2 of 6 in “gitweb: quote base url more consistently”
  1. 0/4 gitweb: quote base url more consistentlyJeff King, Nov 15, 2019
  2. 1/4 t9502: pass along all arguments in xss helperJeff King, Nov 15, 2019
  3. 2/4 t/gitweb-lib.sh: drop confusing quotesJeff King, Nov 15, 2019
  4. 3/4 t/gitweb-lib.sh: set $REQUEST_URIJeff King, Nov 15, 2019
  5. 4/4 gitweb: escape URLs generated by href()Jeff King, Nov 15, 2019
  6. Junio C HamanoNov 18, 2019

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.