Re: [PATCH] gitweb: protect blob and diff output lines from controls.

Jakub Narebski [off-list ref] writes:

Junio C Hamano wrote:

quoted

Jakub Narebski [off-list ref] writes:

quoted

1. First, esc_path should _not_ use subroutine which does it's own 
contol characters escaping. That was also a mistake I made in my patch.
Perhaps we should have some quot_html or to_html subroutine which does 
_only_ to_utf8 (decode from Encode module), escapeHTML and optionally 
s/ / /g conversion.

I hated that original arrangement, 

What did you hate, again?

esc_path calling esc_html you mentioned, of course.

quoted

obviously wrong in the output with the patch you are responding
to.  Except that git_blame2 is missing a chomp() on "my $data"
after finishing the metainfo loop, that is.

The original (mine) code for esc_path uses esc_html, which did it's
own partial (very partial) special characters esaping, namely
\014 (\f) => ^L, \033 (\e) => ^[. So if pathname had form feed character,
it would be replaced by ^L, not '\f'.

I know -- that is what I meant by "code reuse and consistency".

You have added quot_cec to esc_html subroutine directly. I don't know
what is your version of esc_html after the changes you
made,...

See "pu".

Well, the pathname has the limit that it must be in single line
after quoting. The "blob" output is multipage.

I honestly have _no_ idea what distincition you are seeing
here.  Both blob and diff output are processed one line at a
time and its result would be on a single line too.

Dnia czwartek 9. listopada 2006 02:10, Junio C Hamano napisał:

Jakub Narebski [off-list ref] writes:

quoted

Well, the pathname has the limit that it must be in single line
after quoting. The "blob" output is multipage.

I honestly have _no_ idea what distincition you are seeing
here.  Both blob and diff output are processed one line at a
time and its result would be on a single line too.

I was thinking about _conceptual_ difference, not technical.
(Perhaps I should make it more clear.) 

Pathname is item (or part of item in the case of page_path)
which is contained (and must be contained) in single line.
It is also expected (although if we follow this expectation
is up to us) that the pathname would quote special characters
similarly to how shell/operating system quotes pathnames
(e.g. in ls output).

"Blob" output on the other hand ("blob" view and patch part of
"blobdiff" and "commitdiff" views) is [a part of] larger, multiline
whole. One could also expect that special characters would be
quoted like editor quotes special characters. (Of course question
is: which editor?)

This of course is complicate by single line output like subject
or authorship, or signoff, which is not pathname.


All this discussion shows that gitweb quoting is more complicated
that I thought.
-- 
Jakub Narebski