Test

Tests to see how Git web interfaces like GitHub and GitLab work exactly detect bugs.

Mirrors

This repository is mirrored at:

• http://repo.or.cz/w/cirosantilli-test.git. Runs on Girocco. TODO get working.
• https://bitbucket.org/cirosantilli/test
• https://code.google.com/p/cirosantilli-test
• https://github.com/cirosantilli/test
• https://gitlab.com/cirosantilli/test
• https://gitorious.org/cirosantilli-test/cirosantilli-test
• https://sourceforge.net/projects/cirosantilli-test
• https://www.assembla.com/code/cirosantilli-test/git/nodes

Mirrors without repository browsing:

• http://codeplane.com

The SSH of those repos can be found at: remotes.sh,
including other repos which don't have public view like Atlas.

Related repositories

Tests that are very large will not be included here to keep this repository small:

• https://github.com/cirosantilli/test-deep
• https://github.com/cirosantilli/test-diff-many-files
• https://github.com/cirosantilli/test-pr-many-commits

There are also some tests that could not be included here conveniently:

• https://github.com/cirosantilli/test-control-chars
• https://github.com/cirosantilli/test-empty-commit
• https://github.com/cirosantilli/test-empty-subdir
• https://github.com/cirosantilli/test-invalid-utf8
• https://github.com/cirosantilli/test-large-file
• https://github.com/cirosantilli/test-long-filename-1024
• https://github.com/cirosantilli/test-long-filename-256
• https://github.com/cirosantilli/test-min-sane
• https://github.com/cirosantilli/test-refs-api-tags-pulls-block
• https://github.com/cirosantilli/test-symlink-middle-null
• https://github.com/cirosantilli/test-symlink-self
• https://github.com/cirosantilli/test-symlink-start-null
• https://gitlab.com/cirosantilli/test-GIT/tree/master (fails on GitHub)

Other similar repos from other people:

• https://github.com/joernchen/evil_stuff

Other useful things:

• https://github.com/holman/feedback/issues. May contain some extra semi-internal information.

  • https://github.com/showcases/projects-that-power-github
  • https://github.com/holman/feedback/issues/553 GitHub is hosted on Carpathia
  • https://github.com/holman/feedback/issues/544 GitHub uses Mac?

Files

The most interesting files on this repository are:

Markup tests:

• md.md
• issue-md.md: markdown on issues
• adoc.adoc
• rdoc.rdoc

Routing conflict attempts:

• atom.atom
• diff
• diff.diff
• patch.patch

Weird stuff and attacks based on the filenames.

The only filenames which are not valid are:

• contain forward slash /
• .git
• . and .., but not ...

Everything else goes:

• ?a=b&c=d

• "

• #

• '

• :

• ;

• []()

• -

• -start-with-slash

• .md

• whitespace filename edge cases:

  • single whitespace filename
  • double whitespace directory name and its README
  • a b

• Case insensitive filename conflict attempt: CASE, case and CASE-DIR, case-dir. Interestingly, however, .GIT fails: https://gitlab.com/cirosantilli/test-GIT/tree/master

Magic Git directories:

• Git directory inside Git directory: _git.

  For further mischief, the files in that directory were copied to the top-level of the repository.

Other interesting things to do are the uppercase .Git and the .git file, which did not fit well in this repository.

XSS attempts:

• <script></a></li> <li><code>&lt;script src="data:text;utf8,alert('xss')"&gt;</code></li> <li><a class="" href="svg.svg">svg.svg</a>, with an XSS attempt</li> </ul> <h2 id="refs">Refs</h2> <p>Interesting branches and tags:</p> <ul> <li> <p><a class="" href="../hasslash/a"><code>hasslash/a</code></a>: branch inside sub-directory</p> </li> <li> <p><a class="" href="../-r"><code>-r</code></a>: branch with forbidden name, and in particular one that may be used for shell injection. </p> <p>Create manually with <code>cp master -- -r</code> and push with <code>git push --all</code>.</p> </li> <li> <p><code>&lt;script&gt;alert('xss')&lt;/script&gt;</code> and <code>&lt;b&gt;a&lt;/b&gt;</code>: XSS attempts</p> </li> <li> <p><code>tag-empty-blob</code>: a tag that points to a blob</p> </li> <li> <p><a class="" href="a;{echo,INJECTION};{echo,RULZ};"><code>a;{echo,INJECTION};{echo,RULZ};</code></a>: GitHub proposes a shell injection to users on a pull request under "You can also merge branches on the command line". <a href="https://github.com/cirosantilli/test/pull/17">https://github.com/cirosantilli/test/pull/17</a></p> </li> </ul></script>