Thread (4 messages) flat view 4 messages, 2 authors, 2016-08-11

Re: [PATCH 4/n] gitweb: Secure against commit-ish/tree-ish with the same name as path

From: Junio C Hamano <hidden>
Date: 2016-08-11 19:38:04

Jakub Narebski [off-list ref] writes:
Please remove this chunk from patch!. It makes gitweb "tree" view
empty. I have forgot that git-ls-tree _requires_ <tree-ish> so there
is no way to mistake pathspec with <tree-ish>.
To be honest, I dislike these */n series where the the end is
unknown.  It just confuses me what's still surviving, what's
already shot down, and what's being rerolled.

Let's step back a bit and see if we share the same view as to
the status of each one:

[PATCH/RFC 1/n] gitweb: Better git-unquoting and gitweb-quoting of p...

Marked preliminary, perhaps need some discussion and rerolling
but I haven't looked at it.

[PATCH 2/n] gitweb: Use '&iquot;' instead of '?' in esc_path

Discussed; we agreed that showing byte values in different
colors is preferable.  Waiting for re-roll.

[PATCH 3/n] gitweb: Use 's' regexp modifier to secure against filena...

I looked at it although haven't said anything yet.  Probably a
safe and good change but I wonder how LF at the end of the line
matches /...(.+)$/s pattern; iow, if we do not use -z does it
still do the right thing?  Otherwise I suspect you would perhaps
need to chomp?

[PATCH 4/n] gitweb: Secure against commit-ish/tree-ish with the same...

Good fix and even improves readability; will apply after
dropping -- from ls-tree args.

[PATCH 5/n] [take 3] gitweb: New improved patchset view
[PATCH 6/n] gitweb: Remove redundant "blob" links from git_difftree_...
[PATCH 7/n] gitweb: Output also empty patches in "commitdiff" view
[PATCH 8/n] gitweb: Fix two issues with quoted filenames in git_patc...

Haven't looked at them and I do not think people have had enough
time to comment on them yet.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help