Re: gitweb: using quotemeta
From: Luben Tuikov <hidden>
Date: 2016-06-15 22:42:42
--- Luben Tuikov <ltuikov@yahoo.com> wrote:quoted hunk
--- Petr Baudis <pasky@suse.cz> wrote:quoted
Dear diary, on Mon, Oct 02, 2006 at 10:12:56PM CEST, I got a letter where Luben Tuikov [off-list ref] said that...quoted
Escaping for the purposes of HTML _view_ and URL generation is ok, but it is not ok when _saving_ the file with a file name. A file name is just a string of chars, and I want to _save_ the file name as its name is. No changes or interpretations please. I don't care what the string is, what chars it is made of, etc. Please don't interpret file names and their characters when the files are _saved_ by the user's browser. The file name in my filesystem should be the exact same file name as it appears on any other filesystem hosting the same git repo. I don't want this translation: Server FS: linux-2.6.git-5c2d97cb31fb77981797fec46230ca005b865799.tar.gz Quotemeta: linux\-2\.6\.git\-5c2d97cb31fb77981797fec46230ca005b865799\.tar\.gz User FS: linux\-2\.6\.git\-5c2d97cb31fb77981797fec46230ca005b865799\.tar\.gzThen the user agent is buggy - which browser exhibits this behaviour?Latest greatest Firefox for Linux. And no, I don't think that the browser is broken.quoted
According to RFC2183, the filename is a value. According to RFC2045, a value is either a token (uninteresting) or a quoted-string. According to RFC822: quoted-string = <"> *(qtext/quoted-pair) <">; Regular qtext or ; quoted chars. qtext = <any CHAR excepting <">, ; => may be folded "\" & CR, and including linear-white-space> quoted-pair = "\" CHAR ; may quote any char So what we emit is completely correct.(Your quotations do not seem correct according to ftp://ftp.rfc-editor.org/in-notes/rfc2045.txt !) Petr, I agree with your that what we emit is "completely correct". But is is _mangled_. I.e. why mangle the filename from "a.b" to "a\.b" ? Indeed the latter _is_ qtext but it is not the original name given to the file.
Sorry, I ment to say that the latter doesn't appear to be qtext.
Bottomline is that quotemeta does not convert into qtext, and as thus
should never have been used.
Will fix as per your suggestions.
Luben
What actually happened is that _gitweb_ itself mangles the name.quoted
Of course I have nothing against escaping just ", \ and CR. I don't mind just substituting CR with some other string, but please just quote " and \ correctly.Indeed, these three are the only chars NOT ALLOWED in qtext. Will quote those. Thanks for pointing this out.quoted
As of now, gitweb will not handle any filenames containing those three characters properly because of now.Will fix. Thanks, Lubenquoted
-- Petr "Pasky" Baudis Stuff: http://pasky.or.cz/ #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)