On Fri, 26 Aug 2011, Junio C Hamano wrote:
> Jakub Narebski <jnareb@xxxxxxxxx> writes:
>
> > Why use external program (which ming be not installed, or might not
> > strip control-characters), instead of making gitweb sanitize highlighter
> > output itself. Something like the patch below (which additionally
> > shows where there are control characters):
>
> I agree that that would be a more sensible approach. What does your sample
> code below do to a HT by the way?
Actually the line earlier
$line = untabify($line);
replaces HT ("\t") with spaces.
> > -- >8 --
> > diff --git i/gitweb/gitweb.perl w/gitweb/gitweb.perl
> > index 7cf12af..192db2c 100755
> > --- i/gitweb/gitweb.perl
> > +++ w/gitweb/gitweb.perl
> > @@ -1517,6 +1517,17 @@ sub esc_path {
> > return $str;
> > }
> >
> > +# Sanitize for use in XHTML + application/xml+xhtml
> > +sub sanitize {
> > + my $str = shift;
> > +
> > + return undef unless defined $str;
> > +
> > + $str = to_utf8($str);
> > + $str =~ s|([[:cntrl:]])|quot_cec($1)|eg;
> > + return $str;
> > +}
Anyway, it could well be
+ $str =~ s|([[:cntrl:]])|(($1 ne "\t") ? quot_cec($1) : $1)|eg;
+ return $str;
like in esc_html rather than like in esc_path.
> > @@ -6546,7 +6557,8 @@ sub git_blob {
> > $nr++;
> > $line = untabify($line);
^^^^^^^^^^^^^^^^^^^^^^^^
> > printf qq!<div class="pre"><a id="l%i" href="%s#l%i" class="linenr">%4i</a> %s</div>\n!,
> > - $nr, esc_attr(href(-replay => 1)), $nr, $nr, $syntax ? to_utf8($line) : esc_html($line, -nbsp=>1);
> > + $nr, esc_attr(href(-replay => 1)), $nr, $nr,
> > + $syntax ? sanitize($line) : esc_html($line, -nbsp=>1);
> > }
> > }
> > close $fd
--
Jakub Narebski
Poland
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html