[PATCH (lite)] gitweb: Sanitize title attribute in format_subject_html
From: Jakub Narebski <hidden>
Date: 2016-06-15 22:46:48
Subsystem:
the rest · Maintainer:
Linus Torvalds
Replace control characters with question mark '?' (like in chop_and_esc_str). While at it: chop_and_escape_str doesn't need capturing group. Noticed-by: Paul Gortmaker [off-list ref] Signed-off-by: Jakub Narebski <redacted> --- This version has more sane ratio of commit message length to actual change... gitweb/gitweb.perl | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 05702e4..1e7e2d8 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl@@ -1236,7 +1236,7 @@ sub chop_and_escape_str { if ($chopped eq $str) { return esc_html($chopped); } else { - $str =~ s/([[:cntrl:]])/?/g; + $str =~ s/[[:cntrl:]]/?/g; return $cgi->span({-title=>$str}, esc_html($chopped)); } }
@@ -1459,6 +1459,7 @@ sub format_subject_html { $extra = '' unless defined($extra); if (length($short) < length($long)) { + $long =~ s/[[:cntrl:]]/?/g; return $cgi->a({-href => $href, -class => "list subject", -title => to_utf8($long)}, esc_html($short) . $extra);
--
1.6.3.1