Re: [PATCH] gitweb: protect blob and diff output lines from controls.

Jakub Narebski [off-list ref] writes:

Junio C Hamano wrote:

quoted

Jakub Narebski [off-list ref] writes:

quoted

1. First, esc_path should _not_ use subroutine which does it's own 
contol characters escaping. That was also a mistake I made in my patch.
Perhaps we should have some quot_html or to_html subroutine which does 
_only_ to_utf8 (decode from Encode module), escapeHTML and optionally 
s/ / /g conversion.

I hated that original arrangement, 

What did you hate, again?

esc_path calling esc_html you mentioned, of course.

quoted

obviously wrong in the output with the patch you are responding
to.  Except that git_blame2 is missing a chomp() on "my $data"
after finishing the metainfo loop, that is.

The original (mine) code for esc_path uses esc_html, which did it's
own partial (very partial) special characters esaping, namely
\014 (\f) => ^L, \033 (\e) => ^[. So if pathname had form feed character,
it would be replaced by ^L, not '\f'.

I know -- that is what I meant by "code reuse and consistency".

You have added quot_cec to esc_html subroutine directly. I don't know
what is your version of esc_html after the changes you
made,...

See "pu".

Well, the pathname has the limit that it must be in single line
after quoting. The "blob" output is multipage.

I honestly have _no_ idea what distincition you are seeing
here.  Both blob and diff output are processed one line at a
time and its result would be on a single line too.