{"thread":{"id":"12134","subject":"Invalid html output repo.or.cz (alt-git.git)","startedAt":"2008-02-16T13:00:37Z","lastAt":"2008-02-16T22:07:46Z","messageCount":6,"participants":["Martin Koegler","Junio C Hamano","Jakub Narebski","Robert Schiele"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"68900","messageId":"20080216130037.GA14571@auto.tuwien.ac.at","threadId":"12134","inReplyTo":null,"subject":"Invalid html output repo.or.cz (alt-git.git)","fromName":"Martin Koegler","fromEmail":"mkoegler@auto.tuwien.ac.at","sentAt":"2008-02-16T13:00:37Z","receivedAt":"2008-02-16T13:00:37Z","isPatch":false,"sender":{"key":"mkoegler@auto.tuwien.ac.at","avatar":null},"body":"http://repo.or.cz/w/alt-git.git?a=shortlog\n\nfails to load in my Seamonkey browser (Debian stable):\n\nXML Parsing Error: not well-formed\nLocation: http://repo.or.cz/w/alt-git.git?a=shortlog\nLine Number 561, Column 33:<td><i><span title=\"Uwe Kleine-K<span class=\"cntrl\">\\e</span>,Av<span class=\"cntrl\">\\e</span>(Bnig\">Uwe Kleine ...</span></i></td>\n--------------------------------^\n\nmfg Martin Kögler\n"},{"id":"68923","messageId":"7v7ih4908y.fsf@gitster.siamese.dyndns.org","threadId":"12134","inReplyTo":"20080216130037.GA14571@auto.tuwien.ac.at","subject":"Re: Invalid html output repo.or.cz (alt-git.git)","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-02-16T19:20:29Z","receivedAt":"2008-02-16T19:20:29Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"mkoegler@auto.tuwien.ac.at (Martin Koegler) writes:\n\n> http://repo.or.cz/w/alt-git.git?a=shortlog\n>\n> fails to load in my Seamonkey browser (Debian stable):\n\nSorry, that's caused by a bad commit author encoding.  gitweb\nshould ideally be tightened, though.\n"},{"id":"68928","messageId":"m3lk5kbry3.fsf@localhost.localdomain","threadId":"12134","inReplyTo":"20080216130037.GA14571@auto.tuwien.ac.at","subject":"Re: Invalid html output repo.or.cz (alt-git.git)","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2008-02-16T19:52:42Z","receivedAt":"2008-02-16T19:52:42Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Martin Koegler <mkoegler@auto.tuwien.ac.at> writes:\n\n> http://repo.or.cz/w/alt-git.git?a=shortlog\n> \n> fails to load in my Seamonkey browser (Debian stable):\n> \n> XML Parsing Error: not well-formed\n> Location: http://repo.or.cz/w/alt-git.git?a=shortlog\n> Line Number 561, Column 33:<td><i><span title=\"Uwe Kleine-K<span class=\"cntrl\">\\e</span>,Av<span class=\"cntrl\">\\e</span>(Bnig\">Uwe Kleine ...</span></i></td>\n> --------------------------------^\n\nIt looks like gitweb uses esc_html instead of esc_param (or leaving it\nto CGI module) title attribute of span (?) element in a shortlog.\n\nI'd try to fix this bug.\n-- \nJakub Narebski\nPoland\nShadeHawk on #git\n"},{"id":"68930","messageId":"7vve4o7jhz.fsf@gitster.siamese.dyndns.org","threadId":"12134","inReplyTo":"m3lk5kbry3.fsf@localhost.localdomain","subject":"Re: Invalid html output repo.or.cz (alt-git.git)","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-02-16T20:07:36Z","receivedAt":"2008-02-16T20:07:36Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jakub Narebski <jnareb@gmail.com> writes:\n\n> Martin Koegler <mkoegler@auto.tuwien.ac.at> writes:\n>\n>> http://repo.or.cz/w/alt-git.git?a=shortlog\n>> \n>> fails to load in my Seamonkey browser (Debian stable):\n>> \n>> XML Parsing Error: not well-formed\n>> Location: http://repo.or.cz/w/alt-git.git?a=shortlog\n>> Line Number 561, Column 33:<td><i><span title=\"Uwe Kleine-K<span class=\"cntrl\">\\e</span>,Av<span class=\"cntrl\">\\e</span>(Bnig\">Uwe Kleine ...</span></i></td>\n>> --------------------------------^\n>\n> It looks like gitweb uses esc_html instead of esc_param (or leaving it\n> to CGI module) title attribute of span (?) element in a shortlog.\n>\n> I'd try to fix this bug.\n\nThanks.\n"},{"id":"68936","messageId":"20080216211216.GL30676@schiele.dyndns.org","threadId":"12134","inReplyTo":"m3lk5kbry3.fsf@localhost.localdomain","subject":"Re: Invalid html output repo.or.cz (alt-git.git)","fromName":"Robert Schiele","fromEmail":"rschiele@gmail.com","sentAt":"2008-02-16T21:12:17Z","receivedAt":"2008-02-16T21:12:17Z","isPatch":false,"sender":{"key":"rschiele@gmail.com","avatar":"https://gravatar.com/avatar/409473567eb2287d5f0157b51f5b703994b347f24f92172e3a0588741c27a492?d=mp&s=160"},"body":"On Sat, Feb 16, 2008 at 11:52:42AM -0800, Jakub Narebski wrote:\n> Martin Koegler <mkoegler@auto.tuwien.ac.at> writes:\n> \n> > http://repo.or.cz/w/alt-git.git?a=shortlog\n> > \n> > fails to load in my Seamonkey browser (Debian stable):\n> > \n> > XML Parsing Error: not well-formed\n> > Location: http://repo.or.cz/w/alt-git.git?a=shortlog\n> > Line Number 561, Column 33:<td><i><span title=\"Uwe Kleine-K<span class=\"cntrl\">\\e</span>,Av<span class=\"cntrl\">\\e</span>(Bnig\">Uwe Kleine ...</span></i></td>\n> > --------------------------------^\n> \n> It looks like gitweb uses esc_html instead of esc_param (or leaving it\n\nHuh?  Isn't that the wrong escaping?  esc_param is for URLs not for XML\nattributes in general, isn't it?\n\nRobert\n\n-- \nRobert Schiele\nDipl.-Wirtsch.informatiker\tmailto:rschiele@gmail.com\n\n\"Quidquid latine dictum sit, altum sonatur.\"\n"},{"id":"68938","messageId":"200802162307.47323.jnareb@gmail.com","threadId":"12134","inReplyTo":"7vve4o7jhz.fsf@gitster.siamese.dyndns.org","subject":"[PATCH] gitweb: Fix displaying unchopped argument in chop_and_escape_str","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2008-02-16T22:07:46Z","receivedAt":"2008-02-16T22:07:46Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Do not use esc_html to escape [title] _attribute_ of a HTML element,\nand quote unprintable characters.  Replace unprintable characters by\n'?' and use CGI method to generate HTML element and do the escaping.\n\nThis caused bug noticed by Martin Koegler,\n  Message-ID: <20080216130037.GA14571@auto.tuwien.ac.at>\nthat for bad commit encoding in author name, the title attribute (here\nto show full, not shortened name) had embedded HTML code in it, result\nof quoting unprintable characters the gitweb/HTML way. This of course\nbroke the HTML, causing page being not displayed in XML validating web\nbrowsers.\n\nSigned-off-by: Jakub Narebski <jnareb@gmail.com>\n---\n\nJunio C Hamano wrote:\n> Jakub Narebski <jnareb@gmail.com> writes:\n>> Martin Koegler <mkoegler@auto.tuwien.ac.at> writes:\n>>\n>>> http://repo.or.cz/w/alt-git.git?a=shortlog\n>>> \n>>> fails to load in my Seamonkey browser (Debian stable):\n>>> \n>>> XML Parsing Error: not well-formed\n>>> Location: http://repo.or.cz/w/alt-git.git?a=shortlog\n>>> Line Number 561, Column 33:<td><i><span title=\"Uwe Kleine-K<span class=\"cntrl\">\\e</span>,Av<span class=\"cntrl\">\\e</span>(Bnig\">Uwe Kleine ...</span></i></td>\n>>> --------------------------------^\n>>\n>> It looks like gitweb uses esc_html instead of esc_param (or leaving it\n>> to CGI module) title attribute of span (?) element in a shortlog.\n>>\n>> I'd try to fix this bug.\n> \n> Thanks.\n\nAnd here it is. It fixes this bug; I hope there aren't any similar bugs,\nbut I have not checked this. \n\nRobert Schiele wrote:\n> On Sat, Feb 16, 2008 at 11:52:42AM -0800, Jakub Narebski wrote:\n>> \n>> It looks like gitweb uses esc_html instead of esc_param (or leaving it\n> \n> Huh?  Isn't that the wrong escaping?  esc_param is for URLs not for XML\n> attributes in general, isn't it?\n\nTrue, esc_param is for escaping values of CGI parameters, not for\nescaping (and quoting) attributes of HTML element.\n\n\nP.S. I am sorely dissapointed by the fact that CGI version 3.10 doesn't\ndo escaping / quoting of unprintable (control) characters in attributes\n(characters outside specified character set).\n\n gitweb/gitweb.perl |    4 ++--\n 1 files changed, 2 insertions(+), 2 deletions(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex a89b478..acf155c 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -866,8 +866,8 @@ sub chop_and_escape_str {\n \tif ($chopped eq $str) {\n \t\treturn esc_html($chopped);\n \t} else {\n-\t\treturn qq{<span title=\"} . esc_html($str) . qq{\">} .\n-\t\t\tesc_html($chopped) . qq{</span>};\n+\t\t$str =~ s/([[:cntrl:]])/?/g;\n+\t\treturn $cgi->span({-title=>$str}, esc_html($chopped));\n \t}\n }\n \n-- \n1.5.4\n"}]}