Jakub Narebski <jnareb@xxxxxxxxx> writes:
> Why use external program (which ming be not installed, or might not
> strip control-characters), instead of making gitweb sanitize highlighter
> output itself. Something like the patch below (which additionally
> shows where there are control characters):
I agree that that would be a more sensible approach. What does your sample
code below do to a HT by the way?
> -- >8 --
> diff --git i/gitweb/gitweb.perl w/gitweb/gitweb.perl
> index 7cf12af..192db2c 100755
> --- i/gitweb/gitweb.perl
> +++ w/gitweb/gitweb.perl
> @@ -1517,6 +1517,17 @@ sub esc_path {
> return $str;
> }
>
> +# Sanitize for use in XHTML + application/xml+xhtml
> +sub sanitize {
> + my $str = shift;
> +
> + return undef unless defined $str;
> +
> + $str = to_utf8($str);
> + $str =~ s|([[:cntrl:]])|quot_cec($1)|eg;
> + return $str;
> +}
> +
> # Make control characters "printable", using character escape codes (CEC)
> sub quot_cec {
> my $cntrl = shift;
> @@ -6546,7 +6557,8 @@ sub git_blob {
> $nr++;
> $line = untabify($line);
> printf qq!<div class="pre"><a id="l%i" href="%s#l%i" class="linenr">%4i</a> %s</div>\n!,
> - $nr, esc_attr(href(-replay => 1)), $nr, $nr, $syntax ? to_utf8($line) : esc_html($line, -nbsp=>1);
> + $nr, esc_attr(href(-replay => 1)), $nr, $nr,
> + $syntax ? sanitize($line) : esc_html($line, -nbsp=>1);
> }
> }
> close $fd
>
> -- 8< --
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html