Thread (2 messages) flat view 2 messages, 2 authors, 2016-06-15
DORMANTno replies

[PATCH] gitweb: Escape attribute in chop_and_escape_str()

From: Jürgen Kreileder <hidden>
Date: 2016-06-15 22:52:32
Subsystem: the rest · Maintainer: Linus Torvalds

Fixes the title attribute in <span title="Jürgen Kreileder">Jürgen
Kreileder</span>
for example because to_utf8() is called implicitly now.

(Not sure why the attribute is there at all in the example. From my
point of view
nothing got chopped.)

Signed-off-by: Juergen Kreileder <redacted>
---
 gitweb/gitweb.perl |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 4f0c3bd..fd76407 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -1699,7 +1699,7 @@ sub chop_and_escape_str {
 		return esc_html($chopped);
 	} else {
 		$str =~ s/[[:cntrl:]]/?/g;
-		return $cgi->span({-title=>$str}, esc_html($chopped));
+		return $cgi->span({-title => esc_attr($str)}, esc_html($chopped));
 	}
 }
-- 
1.7.5.4
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help