DORMANTno replies

[PATCH] Prevent purely-numeric ref names from breaking Javascript.

From: David Symonds <hidden>
Date: 2016-06-15 22:43:37
Subsystem: the rest · Maintainer: Linus Torvalds

When the server reply carrying JSON data to the client browser to render has
a string that looks like a decimal number, it doesn't get quoted. The
client-side Javascript code assumes, however, that all the ref names are
strings, and so calls string functions on decimal number objects if the ref
name is purely numeric (e.g. "2.5"). This patch simply forces the objects that
are escaped for HTML presentation to be coerced into strings, which catches
this case (and possibly others).
---
 by-commit.html |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/by-commit.html b/by-commit.html
index d759c3e..0aa69b9 100644
--- a/by-commit.html
+++ b/by-commit.html
@@ -35,6 +35,7 @@ format_log_date=function( date )
 }
 escape_html=function( s )
 {
+	s=s+"";	// ensure it's a string
 	s=s.replace( /\&/g, "&amp;" );
 	s=s.replace( /\</g, "&lt;" );
 	s=s.replace( /\>/g, "&gt;" );
-- 
1.5.3.1
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help