Tests to see how Git web interfaces like GitHub and GitLab work exactly detect bugs.

This repository is mirrored at:

• https://github.com/cirosantilli/test
• https://gitlab.com/cirosantilli/test
• https://bitbucket.org/cirosantilli/test
• https://sourceforge.net/projects/cirosantilli-test
• https://code.google.com/p/cirosantilli-test
• https://www.assembla.com/code/cirosantilli-test/git/nodes

The SSH of those repos can be found at: remotes.sh, including other repos which don't have public view like Atlas.

Tests that are very large will not be included here to keep this repository small:

• https://github.com/cirosantilli/test-deep
• https://github.com/cirosantilli/test-diff-many-files
• https://github.com/cirosantilli/test-pr-many-commits

There are also some tests that could not be included here conveniently:

• https://github.com/cirosantilli/test-control-chars
• https://github.com/cirosantilli/test-empty-commit
• https://github.com/cirosantilli/test-empty-subdir
• https://github.com/cirosantilli/test-long-filename-1024
• https://github.com/cirosantilli/test-long-filename-256
• https://github.com/cirosantilli/test-refs-api-tags-pulls-block
• https://github.com/cirosantilli/test-symlink-self
• https://github.com/cirosantilli/test-symlink-middle-null
• https://github.com/cirosantilli/test-symlink-start-null

Other similar repos from other people:

• https://github.com/joernchen/evil_stuff

The most interesting files on this repository are:

• md.md

• issue-md.md: test the markdown on issues

• Weird stuff and attacks based on the filenames.

  The only filenames which are not valid are:

  • contain forward slash /
  • .git
  • . and .., but not ...

  Everything else goes:

  • ?a=b&c=d

  • "

  • '

  • #

  • ;

  • :

  • -start-with-slash

  • <script>

  • <script src="data:text;utf8,alert('xss')">

  • back\slash

  • whitespace filename edge cases:

    • single whitespace filename
    • double whitespace directory name and its README
    • [a b](a b)

• Git directory inside Git directory: _git.

  For further mischief, same files were copied on the top-level of the repository.

Interesting branches and tags:

• hasslash/a: branch inside sub-directory

• -r: branch with forbidden name, and in particular one that may be used for shell injection.

• <script>alert('xss')</script> and <b>a</b>: XSS attempts

  Create manually with cp master -- -r and push with git push --all.

• tag-empty-blob: a tag that points to a blob

• a;{echo,INJECTION};{echo,RULZ};: GitHub proposes a shell injection to users on a pull request under "You can also merge branches on the command line". #17