Before this change, gitweb would generate pages which included: <meta http-equiv="content-type" content="application/xhtml+xml; charset=utf-8"/> A meta element with http-equiv="content-type" is said to be in the "Encoding declaration state". According to the HTML Standard, The Encoding declaration state may be used in HTML documents, but elements with an http-equiv attribute in that state must not be used in XML documents. Source: <https://html.spec.whatwg.org/multipage/semantics.html#attr-meta-http-equiv-content-type> Gitweb always generates XML documents, so its use of http-equiv="content-type" was invalid. This change replaces that tag with <meta charset="utf-8"/> which is equivalent [1] and allowed in XML documents [2]. [1]: <https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#attr-http-equiv> [2]: <https://html.spec.whatwg.org/multipage/semantics.html#attr-meta-charset> Signed-off-by: Jason Yundt <jason@jasonyundt.email> --- gitweb/gitweb.perl | 2 +- t/t9502-gitweb-standalone-parse-output.sh | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl index fbd1c20a23..59457c1004 100755 --- a/gitweb/gitweb.perl +++ b/gitweb/gitweb.perl @@ -4225,7 +4225,7 @@ sub git_header_html { <!-- git web interface version $version, (C) 2005-2006, Kay Sievers <kay.sievers\@vrfy.org>, Christian Gierke --> <!-- git core binaries version $git_version --> <head> -<meta http-equiv="content-type" content="$content_type; charset=utf-8"/> +<meta charset="utf-8"/> <meta name="generator" content="gitweb/$version git/$git_version$mod_perl_version"/> <meta name="robots" content="index, nofollow"/> <title>$title</title> diff --git a/t/t9502-gitweb-standalone-parse-output.sh b/t/t9502-gitweb-standalone-parse-output.sh index e7363511dd..0b06e2d6b0 100755 --- a/t/t9502-gitweb-standalone-parse-output.sh +++ b/t/t9502-gitweb-standalone-parse-output.sh @@ -207,4 +207,20 @@ test_expect_success 'xss checks' ' xss "" "$TAG+" ' +check_encoding_meta_element() { + gitweb_run "$@" && + ! grep -E "http-equiv=['\"]?content-type" gitweb.body && + grep -F '<meta charset="utf-8"/>' gitweb.body +} + +# One of those can be used in XHTML, the other one can't. See: +# <https://html.spec.whatwg.org/dev/semantics.html#attr-meta-charset> +# <https://html.spec.whatwg.org/dev/semantics.html#attr-meta-http-equiv-content-type> +test_expect_success 'no http-equiv="content-type", yes charset="utf-8"' ' + check_encoding_meta_element && + check_encoding_meta_element "p=.git" && + check_encoding_meta_element "p=.git;a=log" && + check_encoding_meta_element "p=.git;a=tree" +' + test_done -- 2.35.1
