[PATCH] Don't open a XML tag while another one...

[PATCH] Don't open a XML tag while another one is already open

From: Robert Schiele <hidden>
Date: 2016-06-15 22:44:14

chop_and_escape_str calls esc_html within a XML tag.  Since esc_html
itself does escape control characters with quot_cec it could potentially
open another tag which leads to incorrect XML.

This patch adds an option "intag" to esc_html and quot_cec to indicate
that we are currently within a tag and thus suppresses opening another
one.  It also makes use of this option in chop_and_escape_str.

Signed-off-by: Robert Schiele <redacted>
---
This patch should fix the bug Martin Koegler reported in his mail "Invalid
html output repo.or.cz (alt-git.git)".

 gitweb/gitweb.perl |   11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 5e88637..a010c7a 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl

@@ -732,7 +732,7 @@ sub esc_html ($;%) {
 	if ($opts{'-nbsp'}) {
 		$str =~ s/ /&nbsp;/g;
 	}
-	$str =~ s|([[:cntrl:]])|(($1 ne "\t") ? quot_cec($1) : $1)|eg;
+	$str =~ s|([[:cntrl:]])|(($1 ne "\t") ? quot_cec($1, -intag=>$opts{'-intag'}) : $1)|eg;
 	return $str;
 }

@@ -753,6 +753,7 @@ sub esc_path {
 # Make control characters "printable", using character escape codes (CEC)
 sub quot_cec {
 	my $cntrl = shift;
+	my %opts = @_;
 	my %es = ( # character escape codes, aka escape sequences
 		   "\t" => '\t',   # tab            (HT)
 		   "\n" => '\n',   # line feed      (LF)

@@ -767,7 +768,11 @@ sub quot_cec {
 	my $chr = ( (exists $es{$cntrl})
 		    ? $es{$cntrl}
 		    : sprintf('\%03o', ord($cntrl)) );
-	return "<span class=\"cntrl\">$chr</span>";
+	if ($opts{'-intag'}) {
+		return "$chr";
+	} else {
+		return "<span class=\"cntrl\">$chr</span>";
+	}
 }
 
 # Alternatively use unicode control pictures codepoints,

@@ -866,7 +871,7 @@ sub chop_and_escape_str {
 	if ($chopped eq $str) {
 		return esc_html($chopped);
 	} else {
-		return qq{<span title="} . esc_html($str) . qq{">} .
+		return qq{<span title="} . esc_html($str, -intag=>1) . qq{">} .
 			esc_html($chopped) . qq{</span>};
 	}
 }

-- 
1.5.2.4

[PATCH] gitweb: Add new option -nohtml to quot_xxx subroutines

From: Jakub Narebski <hidden>
Date: 2016-06-15 22:44:14

Add support for new option -nohtml to quot_cec and quot_upr
subroutines, to have output not wrapped in HTML tags.  This makes
those subroutines suitable to quoting attributes values, and for plain
text output quoting.  Currently this API is not used yet.

While at it fix whitespace, and use ';' as delimiter, not separator.


The option to not wrap quot_cec output in HTML tag were proposed
originally in patch:
  "Don't open a XML tag while another one is already open"
  Message-ID: [off-list ref]
by Robert Schiele.  Originally the parameter was named '-notag', was
also supportted by esc_html (but not esc_path) which passed it down to
quot_cec.  Mentioned patch was meant to fix the bug Martin Koegler
reported in his mail
  "Invalid html output repo.or.cz (alt-git.git)"
  Message-ID: [off-list ref]
which was fixed in different way (do not use esc_html to escape and
quote HTML attributes).


Signed-off-by: Robert Schiele <redacted>
Signed-off-by: Jakub Narebski <redacted>
---

 gitweb/gitweb.perl |   37 ++++++++++++++++++++++++-------------
 1 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index acf155c..b598366 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl

@@ -753,29 +753,40 @@ sub esc_path {
 # Make control characters "printable", using character escape codes (CEC)
 sub quot_cec {
 	my $cntrl = shift;
+	my %opts = @_;
 	my %es = ( # character escape codes, aka escape sequences
-		   "\t" => '\t',   # tab            (HT)
-		   "\n" => '\n',   # line feed      (LF)
-		   "\r" => '\r',   # carrige return (CR)
-		   "\f" => '\f',   # form feed      (FF)
-		   "\b" => '\b',   # backspace      (BS)
-		   "\a" => '\a',   # alarm (bell)   (BEL)
-		   "\e" => '\e',   # escape         (ESC)
-		   "\013" => '\v', # vertical tab   (VT)
-		   "\000" => '\0', # nul character  (NUL)
-		   );
+		"\t" => '\t',   # tab            (HT)
+		"\n" => '\n',   # line feed      (LF)
+		"\r" => '\r',   # carrige return (CR)
+		"\f" => '\f',   # form feed      (FF)
+		"\b" => '\b',   # backspace      (BS)
+		"\a" => '\a',   # alarm (bell)   (BEL)
+		"\e" => '\e',   # escape         (ESC)
+		"\013" => '\v', # vertical tab   (VT)
+		"\000" => '\0', # nul character  (NUL)
+	);
 	my $chr = ( (exists $es{$cntrl})
 		    ? $es{$cntrl}
 		    : sprintf('\%03o', ord($cntrl)) );
-	return "<span class=\"cntrl\">$chr</span>";
+	if ($opts{-nohtml}) {
+		return $chr;
+	} else {
+		return "<span class=\"cntrl\">$chr</span>";
+	}
 }
 
 # Alternatively use unicode control pictures codepoints,
 # Unicode "printable representation" (PR)
 sub quot_upr {
 	my $cntrl = shift;
+	my %opts = @_;
+
 	my $chr = sprintf('&#%04d;', 0x2400+ord($cntrl));
-	return "<span class=\"cntrl\">$chr</span>";
+	if ($opts{-nohtml}) {
+		return $chr;
+	} else {
+		return "<span class=\"cntrl\">$chr</span>";
+	}
 }
 
 # git may return quoted and escaped filenames

@@ -800,7 +811,7 @@ sub unquote {
 			return chr(oct($seq));
 		} elsif (exists $es{$seq}) {
 			# C escape sequence, aka character escape code
-			return $es{$seq}
+			return $es{$seq};
 		}
 		# quoted ordinary character
 		return $seq;

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help