On Tue, Nov 13, 2012 at 6:04 PM, Jeff King <peff@xxxxxxxx> wrote: > On Tue, Nov 13, 2012 at 09:44:06AM -0500, Drew Northup wrote: >> Besides, inserting one call to esc_html only fixes one attack path. I >> didn't look to see if all others were already covered. > > Properly quoting output is something that the web framework should do > for you. gitweb uses CGI.pm, which does help with that, but we do not > use it consistently. If there are other problematic areas, I think the > best path forward is to use our framework more. Well, calling CGI.pm a _framework_ is overly generous, but it does include some HTML generation subroutines / methods, and gitweb makes use of them, especially $cgi->a() for links. But it cannot help in this case, because here we are generating XML: RSS or Atom feed. There was proposal some time ago to switch to using XML::FeedPP or XML::Atom::Feed + XML::RSS::Feed for feed generation. Perhaps it is high time to switch to some Perl web (micro)framework, like Dancer, Mojolicious or Catalyst... but not requiring extra modules has its advantages (and there always exist Gitalist). -- Jakub Narebski -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html