{"thread":{"id":"24601","subject":"gitweb not friendly to firefox revived","startedAt":"2010-08-01T19:51:38Z","lastAt":"2010-09-07T08:22:53Z","messageCount":12,"participants":["Uwe Kleine-König","Ævar Arnfjörð Bjarmason","Jakub Narebski","Stephen Boyd"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"146913","messageId":"20100801195138.GA1980@pengutronix.de","threadId":"24601","inReplyTo":null,"subject":"gitweb not friendly to firefox revived","fromName":"Uwe Kleine-König","fromEmail":"u.kleine-koenig@pengutronix.de","sentAt":"2010-08-01T19:51:38Z","receivedAt":"2010-08-01T19:51:38Z","isPatch":false,"sender":{"key":"u.kleine-koenig@pengutronix.de","avatar":"https://gravatar.com/avatar/354b5e3ceb2806a2f1e1e382ac29ddbdad18288654da62b61eb13583a857eee7?d=mp&s=160"},"body":"Hello,\n\ngitweb (at least) doesn't quote author names enough.\n\nFirefox barfs for me at looking at\n\n\thttp://git.pengutronix.de/?p=ukl/linux-2.6.git;a=shortlog;h=v2.6.16.10\n\nwith an error:\n\n\tXML Parsing Error: not well-formed Location:\nhttp://git.pengutronix.de/?p=ukl/linux-2.6.git;a=shortlog;h=v2.6.16.10\nLine Number 112, Column 81:\n| YOSHIFUJI Hideaki... | [PATCH] IPV6: XFRM: Fix decoding session with preceding... | \n--------------------------------------------------------------------------------^\n\nThis is with git 1.7.1 and Iceweasel (aka. Firefox) 3.5.10.\n\nMaking\n\n\ttitle=>\"Search for commits $performed by $author\"\n\nin line 1694 of Debian's /usr/lib/cgi-bin/gitweb.cgi from the git 1.7.1\npackage read\n\n\ttitle=>esc_html(\"Search for commits $performed by $author\")\n\nthis problem goes away. (Still my browser barfs when clicking at the name.)\n\nI'm not sure if this is the right way to fix this and I'm too tired now\nto do a complete patch, so I let this for someone else.\n\nBest regards\nUwe\n\n-- \nPengutronix e.K. | Uwe Kleine-König |\nIndustrial Linux Solutions | http://www.pengutronix.de/ |\n"},{"id":"146915","messageId":"AANLkTimZ_DxO_TGnDBwRnurcdFuct-t509F0+DRhHo+B@mail.gmail.com","threadId":"24601","inReplyTo":"20100801195138.GA1980@pengutronix.de","subject":"Re: gitweb not friendly to firefox revived","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2010-08-01T20:15:16Z","receivedAt":"2010-08-01T20:15:16Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"2010/8/1 Uwe Kleine-König :\n\n> This is with git 1.7.1 and Iceweasel (aka. Firefox) 3.5.10.\n>\n> Making\n>\n> title=>\"Search for commits $performed by $author\"\n>\n> in line 1694 of Debian's /usr/lib/cgi-bin/gitweb.cgi from the git 1.7.1\n> package read\n>\n> title=>esc_html(\"Search for commits $performed by $author\")\n>\n> this problem goes away. (Still my browser barfs when clicking at the name.)\n\nThat fix seems correct, the author appears to have control characters\nin his name. Probably as a result of some encoding corruption.\n\nWhat's the URL of the Git repository itself? It'd be interesting to\nsee how that went wrong in the first place.\n"},{"id":"146916","messageId":"m3lj8qozan.fsf@localhost.localdomain","threadId":"24601","inReplyTo":"20100801195138.GA1980@pengutronix.de","subject":"Re: gitweb not friendly to firefox revived","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2010-08-01T20:26:16Z","receivedAt":"2010-08-01T20:26:16Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Uwe Kleine-König writes:\n\n> Hello,\n> \n> gitweb (at least) doesn't quote author names enough.\n> \n> Firefox barfs for me at looking at\n> \n> \thttp://git.pengutronix.de/?p=ukl/linux-2.6.git;a=shortlog;h=v2.6.16.10\n> \n> with an error:\n> \n> \tXML Parsing Error: not well-formed Location:\n> http://git.pengutronix.de/?p=ukl/linux-2.6.git;a=shortlog;h=v2.6.16.10\n> Line Number 112, Column 81:\n> YOSHIFUJI Hideaki... | [PATCH] IPV6: XFRM: Fix decoding session with preceding... | \n> --------------------------------------------------------------------------------^\n> \n> This is with git 1.7.1 and Iceweasel (aka. Firefox) 3.5.10.\n> \n> Making\n> \n> \ttitle=>\"Search for commits $performed by $author\"\n> \n> in line 1694 of Debian's /usr/lib/cgi-bin/gitweb.cgi from the git 1.7.1\n> package read\n> \n> \ttitle=>esc_html(\"Search for commits $performed by $author\")\n> \n> this problem goes away. (Still my browser barfs when clicking at the name.)\n> \n> I'm not sure if this is the right way to fix this and I'm too tired now\n> to do a complete patch, so I let this for someone else.\n\nActually gitweb leaves quoting of tag attributes to CGI module:\n\n return $cgi->a({-href => href(action=>\"search\", hash=>$hash,\n searchtext=>$author, searchtype=>$searchtype),\n -class => \"list\",\n -title => \"Search for commits $performed by $author\"},\n $displaytext);\n\nI am worrying (perhaps unnecessary) that using esc_html would result\nin double escaping. But it looks like the problem is with Unicode,\nso perhaps using\n\n \ttitle => to_utf8(\"Search for commits $performed by $author\")\n\nin place of\n\n \ttitle=>esc_html(\"Search for commits $performed by $author\")\n\nwould be a better fix? Does this fix work for you?\n\n\nCc-ed Stephen Boyd, who is author of commit e133d65 (gitweb: linkify\nauthor/committer names with search, 2009-10-15), introducing the code\nyou found this bug in.\n\n-- \nJakub Narebski\nPoland\nShadeHawk on #git\n"},{"id":"146929","messageId":"20100802053115.GB8538@pengutronix.de","threadId":"24601","inReplyTo":"AANLkTimZ_DxO_TGnDBwRnurcdFuct-t509F0+DRhHo+B@mail.gmail.com","subject":"Re: gitweb not friendly to firefox revived","fromName":"Uwe Kleine-König","fromEmail":"u.kleine-koenig@pengutronix.de","sentAt":"2010-08-02T05:31:15Z","receivedAt":"2010-08-02T05:31:15Z","isPatch":false,"sender":{"key":"u.kleine-koenig@pengutronix.de","avatar":"https://gravatar.com/avatar/354b5e3ceb2806a2f1e1e382ac29ddbdad18288654da62b61eb13583a857eee7?d=mp&s=160"},"body":"Hi,\n\n> What's the URL of the Git repository itself? It'd be interesting to\n> see how that went wrong in the first place.\nit's just a copy of 2.6.16.y that is available at kernel.org:\ngit://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.16.y.git\n\nThe commit happend before 2.6.16.10.\n\nBest regards\nUwe\n\n-- \nPengutronix e.K. | Uwe Kleine-König |\nIndustrial Linux Solutions | http://www.pengutronix.de/ |\n"},{"id":"147071","messageId":"20100803210730.GA1254@pengutronix.de","threadId":"24601","inReplyTo":"m3lj8qozan.fsf@localhost.localdomain","subject":"Re: gitweb not friendly to firefox revived","fromName":"Uwe Kleine-König","fromEmail":"u.kleine-koenig@pengutronix.de","sentAt":"2010-08-03T21:07:30Z","receivedAt":"2010-08-03T21:07:30Z","isPatch":false,"sender":{"key":"u.kleine-koenig@pengutronix.de","avatar":"https://gravatar.com/avatar/354b5e3ceb2806a2f1e1e382ac29ddbdad18288654da62b61eb13583a857eee7?d=mp&s=160"},"body":"On Sun, Aug 01, 2010 at 01:26:16PM -0700, Jakub Narebski wrote:\n> Uwe Kleine-König writes:\n> \n> > Hello,\n> > \n> > gitweb (at least) doesn't quote author names enough.\n> > \n> > Firefox barfs for me at looking at\n> > \n> > \thttp://git.pengutronix.de/?p=ukl/linux-2.6.git;a=shortlog;h=v2.6.16.10\n> > \n> > with an error:\n> > \n> > \tXML Parsing Error: not well-formed Location:\n> > http://git.pengutronix.de/?p=ukl/linux-2.6.git;a=shortlog;h=v2.6.16.10\n> > Line Number 112, Column 81:\n> > YOSHIFUJI Hideaki... | [PATCH] IPV6: XFRM: Fix decoding session with preceding... | \n> > --------------------------------------------------------------------------------^\n> > \n> > This is with git 1.7.1 and Iceweasel (aka. Firefox) 3.5.10.\n> > \n> > Making\n> > \n> > \ttitle=>\"Search for commits $performed by $author\"\n> > \n> > in line 1694 of Debian's /usr/lib/cgi-bin/gitweb.cgi from the git 1.7.1\n> > package read\n> > \n> > \ttitle=>esc_html(\"Search for commits $performed by $author\")\n> > \n> > this problem goes away. (Still my browser barfs when clicking at the name.)\n> > \n> > I'm not sure if this is the right way to fix this and I'm too tired now\n> > to do a complete patch, so I let this for someone else.\n> \n> Actually gitweb leaves quoting of tag attributes to CGI module:\n> \n> return $cgi->a({-href => href(action=>\"search\", hash=>$hash,\n> searchtext=>$author, searchtype=>$searchtype),\n> -class => \"list\",\n> -title => \"Search for commits $performed by $author\"},\n> $displaytext);\n> \n> I am worrying (perhaps unnecessary) that using esc_html would result\n> in double escaping. But it looks like the problem is with Unicode,\n> so perhaps using\n> \n> \ttitle => to_utf8(\"Search for commits $performed by $author\")\n> \n> in place of\n> \n> \ttitle=>esc_html(\"Search for commits $performed by $author\")\n> \n> would be a better fix? Does this fix work for you?\nNo, this doesn't help. Firefox still barfs with to_utf8.\n\nWith esc_html the code generated is:\n\n\\e$B5HF#1QL@\\e(B\" class=\"list\" href=\"/?p=.git;a=search;h=f66ab685594d49e570b2176cfa20b03360e9a6e9;s=YOSHIFUJI+Hideaki+/+%1B%24B5HF%231QL@%1B(B;st=author\">YOSHIFUJI Hideaki... \n\nThanks\nUwe\n\n-- \nPengutronix e.K. | Uwe Kleine-König |\nIndustrial Linux Solutions | http://www.pengutronix.de/ |\n"},{"id":"147075","messageId":"201008032350.40117.jnareb@gmail.com","threadId":"24601","inReplyTo":"20100803210730.GA1254@pengutronix.de","subject":"Re: gitweb not friendly to firefox revived","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2010-08-03T21:50:38Z","receivedAt":"2010-08-03T21:50:38Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"On Tue, Aug 03, 2010, Uwe Kleine-König wrote:\n> On Sun, Aug 01, 2010 at 01:26:16PM -0700, Jakub Narebski wrote:\n> > Uwe Kleine-König writes:\n> > \n> > > Hello,\n> > > \n> > > gitweb (at least) doesn't quote author names enough.\n> > > \n> > > Firefox barfs for me at looking at\n> > > \n> > > \thttp://git.pengutronix.de/?p=ukl/linux-2.6.git;a=shortlog;h=v2.6.16.10\n> > > \n> > > with an error:\n> > > \n> > > \tXML Parsing Error: not well-formed Location:\n> > > http://git.pengutronix.de/?p=ukl/linux-2.6.git;a=shortlog;h=v2.6.16.10\n> > > Line Number 112, Column 81:\n> > > YOSHIFUJI Hideaki... | [PATCH] IPV6: XFRM: Fix decoding session with preceding... | \n> > > --------------------------------------------------------------------------------^\n> > > \n> > > This is with git 1.7.1 and Iceweasel (aka. Firefox) 3.5.10.\n> > > \n> > > Making\n> > > \n> > > \ttitle=>\"Search for commits $performed by $author\"\n> > > \n> > > in line 1694 of Debian's /usr/lib/cgi-bin/gitweb.cgi from the git 1.7.1\n> > > package read\n> > > \n> > > \ttitle=>esc_html(\"Search for commits $performed by $author\")\n> > > \n> > > this problem goes away. (Still my browser barfs when clicking at the name.)\n> > > \n> > > I'm not sure if this is the right way to fix this and I'm too tired now\n> > > to do a complete patch, so I let this for someone else.\n> > \n> > Actually gitweb leaves quoting of tag attributes to CGI module:\n> > \n> > return $cgi->a({-href => href(action=>\"search\", hash=>$hash,\n> > searchtext=>$author, searchtype=>$searchtype),\n> > -class => \"list\",\n> > -title => \"Search for commits $performed by $author\"},\n> > $displaytext);\n> > \n> > I am worrying (perhaps unnecessary) that using esc_html would result\n> > in double escaping. But it looks like the problem is with Unicode,\n> > so perhaps using\n> > \n> > \ttitle => to_utf8(\"Search for commits $performed by $author\")\n> > \n> > in place of\n> > \n> > \ttitle=>esc_html(\"Search for commits $performed by $author\")\n> > \n> > would be a better fix? Does this fix work for you?\n>\n> No, this doesn't help. Firefox still barfs with to_utf8.\n> \n> With esc_html the code generated is:\n> \n> \\e$B5HF#1QL@\\e(B\" class=\"list\" href=\"/?p=.git;a=search;h=f66ab685594d49e570b2176cfa20b03360e9a6e9;s=YOSHIFUJI+Hideaki+/+%1B%24B5HF%231QL@%1B(B;st=author\">YOSHIFUJI Hideaki... \n\nAs you can see the HTML code generated with esc_html solution is way wrong\nbecause of embedded '\\e' as you see _without_\n'\"' being escaped, so HTML is wrong.\n\nNevertheless it shows what's the problem. Somehow (perhaps wrong\nencoding, perhaps screw up with quoted-printable and git-am, perhaps\ncopy'n' paste included ANSII color codes from terminal, perhaps something\ndifferent altogether) you got control characters (\\e = ESC) in $author.\nIn strict XHTML mode (with 'application/xml\n\nPlease try the following patch\n\n-- >8 --\nFrom: Jakub Narebski \nSubject: [PATCH] gitweb: Harden format_search_author()\n\nProtect format_search_author against control characters in $author.\nWhile at it simplify it a bit, and use spaces for align.\n\nSigned-off-by: Jakub Narebski \n---\n gitweb/gitweb.perl | 29 ++++++++++++++---------------\n 1 files changed, 14 insertions(+), 15 deletions(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex 8b02767..ea9c09c 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -1856,23 +1856,22 @@ sub format_search_author {\n \tmy ($author, $searchtype, $displaytext) = @_;\n \tmy $have_search = gitweb_check_feature('search');\n \n-\tif ($have_search) {\n-\t\tmy $performed = \"\";\n-\t\tif ($searchtype eq 'author') {\n-\t\t\t$performed = \"authored\";\n-\t\t} elsif ($searchtype eq 'committer') {\n-\t\t\t$performed = \"committed\";\n-\t\t}\n-\n-\t\treturn $cgi->a({-href => href(action=>\"search\", hash=>$hash,\n-\t\t\t\tsearchtext=>$author,\n-\t\t\t\tsearchtype=>$searchtype), class=>\"list\",\n-\t\t\t\ttitle=>\"Search for commits $performed by $author\"},\n-\t\t\t\t$displaytext);\n+\treturn $displaytext unless ($have_search);\n \n-\t} else {\n-\t\treturn $displaytext;\n+\tmy $performed = \"\";\n+\tif ($searchtype eq 'author') {\n+\t\t$performed = \"authored\";\n+\t} elsif ($searchtype eq 'committer') {\n+\t\t$performed = \"committed\";\n \t}\n+\n+\tmy $title = to_utf8(\"Search for commits $performed by $author\");\n+\t$title =~ s/[[:cntrl:]]/?/g;\n+\n+\treturn $cgi->a({-href => href(action=>\"search\", hash=>$hash,\n+\t searchtext=>$author, searchtype=>$searchtype),\n+\t -class=>\"list\", -title=>$title},\n+\t $displaytext);\n }\n \n # format the author name of the given commit with the given tag\n-- \n1.7.2.1\n"},{"id":"147886","messageId":"20100812092356.GC9763@pengutronix.de","threadId":"24601","inReplyTo":"201008032350.40117.jnareb@gmail.com","subject":"Re: gitweb not friendly to firefox revived","fromName":"Uwe Kleine-König","fromEmail":"u.kleine-koenig@pengutronix.de","sentAt":"2010-08-12T09:23:56Z","receivedAt":"2010-08-12T09:23:56Z","isPatch":false,"sender":{"key":"u.kleine-koenig@pengutronix.de","avatar":"https://gravatar.com/avatar/354b5e3ceb2806a2f1e1e382ac29ddbdad18288654da62b61eb13583a857eee7?d=mp&s=160"},"body":"Hello,\n\n> Nevertheless it shows what's the problem. Somehow (perhaps wrong\n> encoding, perhaps screw up with quoted-printable and git-am, perhaps\n> copy'n' paste included ANSII color codes from terminal, perhaps something\n> different altogether) you got control characters (\\e = ESC) in $author.\n> In strict XHTML mode (with 'application/xml\n> \n> Please try the following patch\n> \n> -- >8 --\n> From: Jakub Narebski \n> Subject: [PATCH] gitweb: Harden format_search_author()\n> \n> Protect format_search_author against control characters in $author.\n> While at it simplify it a bit, and use spaces for align.\n> \n> Signed-off-by: Jakub Narebski \n> ---\n> gitweb/gitweb.perl | 29 ++++++++++++++---------------\n> 1 files changed, 14 insertions(+), 15 deletions(-)\n> \n> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\n> index 8b02767..ea9c09c 100755\n> --- a/gitweb/gitweb.perl\n> +++ b/gitweb/gitweb.perl\n> @@ -1856,23 +1856,22 @@ sub format_search_author {\n> \tmy ($author, $searchtype, $displaytext) = @_;\n> \tmy $have_search = gitweb_check_feature('search');\n> \n> -\tif ($have_search) {\n> -\t\tmy $performed = \"\";\n> -\t\tif ($searchtype eq 'author') {\n> -\t\t\t$performed = \"authored\";\n> -\t\t} elsif ($searchtype eq 'committer') {\n> -\t\t\t$performed = \"committed\";\n> -\t\t}\n> -\n> -\t\treturn $cgi->a({-href => href(action=>\"search\", hash=>$hash,\n> -\t\t\t\tsearchtext=>$author,\n> -\t\t\t\tsearchtype=>$searchtype), class=>\"list\",\n> -\t\t\t\ttitle=>\"Search for commits $performed by $author\"},\n> -\t\t\t\t$displaytext);\n> +\treturn $displaytext unless ($have_search);\n> \n> -\t} else {\n> -\t\treturn $displaytext;\n> +\tmy $performed = \"\";\n> +\tif ($searchtype eq 'author') {\n> +\t\t$performed = \"authored\";\n> +\t} elsif ($searchtype eq 'committer') {\n> +\t\t$performed = \"committed\";\n> \t}\n> +\n> +\tmy $title = to_utf8(\"Search for commits $performed by $author\");\n> +\t$title =~ s/[[:cntrl:]]/?/g;\n> +\n> +\treturn $cgi->a({-href => href(action=>\"search\", hash=>$hash,\n> +\t searchtext=>$author, searchtype=>$searchtype),\n> +\t -class=>\"list\", -title=>$title},\n> +\t $displaytext);\n> }\nSeems to do the right thing. With Firefox I get a correct listing now\ninstead of the xml parse error.\n\nThanks\nUwe\n\n-- \nPengutronix e.K. | Uwe Kleine-König |\nIndustrial Linux Solutions | http://www.pengutronix.de/ |\n"},{"id":"148079","messageId":"4C6670EE.3060806@gmail.com","threadId":"24601","inReplyTo":"201008032350.40117.jnareb@gmail.com","subject":"Re: gitweb not friendly to firefox revived","fromName":"Stephen Boyd","fromEmail":"bebarino@gmail.com","sentAt":"2010-08-14T10:33:18Z","receivedAt":"2010-08-14T10:33:18Z","isPatch":false,"sender":{"key":"bebarino@gmail.com","avatar":"https://avatars.githubusercontent.com/u/38832?v=4"},"body":" On 08/03/2010 02:50 PM, Jakub Narebski wrote:\n> +\n> +\tmy $title = to_utf8(\"Search for commits $performed by $author\");\n> +\t$title =~ s/[[:cntrl:]]/?/g;\n> +\n>\n\nIsn't it possible that other data coming from git could have escape characters in them such as the commit subject line? In which case this same bug would occur?\n\nTherefore isn't it better to strip out control characters (that's what this patch is doing right?) in esc_html?\n"},{"id":"148081","messageId":"AANLkTimR9Wkz+YOchyjvO8fgAwk5YsGtcpMOpyZY4Fjv@mail.gmail.com","threadId":"24601","inReplyTo":"4C6670EE.3060806@gmail.com","subject":"Re: gitweb not friendly to firefox revived","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2010-08-14T10:48:08Z","receivedAt":"2010-08-14T10:48:08Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"2010/8/14 Stephen Boyd :\n> On 08/03/2010 02:50 PM, Jakub Narebski wrote:\n>>\n>> +\n>> + my $title = to_utf8(\"Search for commits $performed by $author\");\n>> + $title =~ s/[[:cntrl:]]/?/g;\n>> +\n>>\n>\n> Isn't it possible that other data coming from git could have escape\n> characters in them such as the commit subject line? In which case this same\n> bug would occur?\n>\n> Therefore isn't it better to strip out control characters (that's what this\n> patch is doing right?) in esc_html?\n\nI don't think stripping them out is the right thing either, hiding\nfrom you that something is Really Wrong (binary garbage in patches)\nisn't good.\n\nSomething like this would be better:\n\n s/([[:cntrl:]])/sprintf(\"\\\\%03x\", ord $1)/ge\n\nE.g.:\n\n $ perl -E 'my $s = join \"\", map { chr } 1 .. 40; $s =~\ns/([[:cntrl:]])/sprintf(\"\\\\%03x\", ord $1)/ge; say $s'\n \\001\\002\\003\\004\\005\\006\\007\\008\\009\\00a\\00b\\00c\\00d\\00e\\00f\\010\\011\\012\\013\\014\\015\\016\\017\\018\\019\\01a\\01b\\01c\\01d\\01e\\01f\n!\"#$%&'(\n"},{"id":"148083","messageId":"201008141429.36829.jnareb@gmail.com","threadId":"24601","inReplyTo":"4C6670EE.3060806@gmail.com","subject":"Re: gitweb not friendly to firefox revived","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2010-08-14T12:29:35Z","receivedAt":"2010-08-14T12:29:35Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"On Sat, 14 Aug 2010, Stephen Boyd wrote:\n> On 08/03/2010 02:50 PM, Jakub Narebski wrote:\n> > +\n> > +\tmy $title = to_utf8(\"Search for commits $performed by $author\");\n> > +\t$title =~ s/[[:cntrl:]]/?/g;\n> > +\n> >\n> \n> Isn't it possible that other data coming from git could have escape\n> characters in them such as the commit subject line? In which case this\n> same bug would occur? \n> \n> Therefore isn't it better to strip out control characters (that's what\n> this patch is doing right?) in esc_html? \n\nFirst, esc_html and esc_path *do* escape control characters using\neither control escape characters (e.g. \"\\n\" for LF), or escaped octal \nrepresentation (e.g. \"\\001\").\n\nSecond, it does not help with contents of *attributes* of HTML tag \nelements (like e.g. 'title' attribute) when those elements are \ngenerated using CGI (e.g. $cgi->a({..., -title => ...},esc_html(...))).\nUnfortunately (older?) CGI.pm does not escape control characters, and\nwe cannot do escape ourselves because it would lead to double escaping.\n\n\nThe problem with Firefox is that in strict XHTML conformance model \n(XHTML DTD and application/xhtml+xml mimetype) it *enforces* that XML\nis well formed, which includes lack of control characters, instead of\nsilently allowing it like in more loose HTML mode.\n\n-- \nJakub Narebski\nPoland\n"},{"id":"148084","messageId":"201008141433.35451.jnareb@gmail.com","threadId":"24601","inReplyTo":"AANLkTimR9Wkz+YOchyjvO8fgAwk5YsGtcpMOpyZY4Fjv@mail.gmail.com","subject":"Re: gitweb not friendly to firefox revived","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2010-08-14T12:33:33Z","receivedAt":"2010-08-14T12:33:33Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"On Sat, 14 Aug 2010, Ævar Arnfjörð Bjarmason wrote:\n> 2010/8/14 Stephen Boyd :\n>> On 08/03/2010 02:50 PM, Jakub Narebski wrote:\n>>>\n>>> +\n>>> + my $title = to_utf8(\"Search for commits $performed by $author\");\n>>> + $title =~ s/[[:cntrl:]]/?/g;\n>>> +\n>>>\n>>\n>> Isn't it possible that other data coming from git could have escape\n>> characters in them such as the commit subject line? In which case this same\n>> bug would occur?\n>>\n>> Therefore isn't it better to strip out control characters (that's what this\n>> patch is doing right?) in esc_html?\n> \n> I don't think stripping them out is the right thing either, hiding\n> from you that something is Really Wrong (binary garbage in patches)\n> isn't good.\n> \n> Something like this would be better:\n> \n> s/([[:cntrl:]])/sprintf(\"\\\\%03x\", ord $1)/ge\n\nOr \n s|([[:cntrl:]])|quot_cec($1)|eg;\n\nBut is it worth it? This is about _title_ attribute, shown only on \nmouseover (mouse hover).\n\n\nBut perhaps it would be worth it to add 'prep_attr' and 'esc_attr'\nfunctions, though esc_html can be used in those places where esc_attr\nwould be needed...\n\n-- \nJakub Narebski\nPoland\n"},{"id":"150196","messageId":"20100907082253.GA16198@pengutronix.de","threadId":"24601","inReplyTo":"201008141433.35451.jnareb@gmail.com","subject":"Re: gitweb not friendly to firefox revived","fromName":"Uwe Kleine-König","fromEmail":"u.kleine-koenig@pengutronix.de","sentAt":"2010-09-07T08:22:53Z","receivedAt":"2010-09-07T08:22:53Z","isPatch":false,"sender":{"key":"u.kleine-koenig@pengutronix.de","avatar":"https://gravatar.com/avatar/354b5e3ceb2806a2f1e1e382ac29ddbdad18288654da62b61eb13583a857eee7?d=mp&s=160"},"body":"Hello,\n\njust to stop this topic dying ...\n\nOn Sat, Aug 14, 2010 at 02:33:33PM +0200, Jakub Narebski wrote:\n> On Sat, 14 Aug 2010, Ævar Arnfjörð Bjarmason wrote:\n> > 2010/8/14 Stephen Boyd :\n> >> On 08/03/2010 02:50 PM, Jakub Narebski wrote:\n> >>>\n> >>> +\n> >>> + my $title = to_utf8(\"Search for commits $performed by $author\");\n> >>> + $title =~ s/[[:cntrl:]]/?/g;\n> >>> +\n> >>>\n> >>\n> >> Isn't it possible that other data coming from git could have escape\n> >> characters in them such as the commit subject line? In which case this same\n> >> bug would occur?\n> >>\n> >> Therefore isn't it better to strip out control characters (that's what this\n> >> patch is doing right?) in esc_html?\n> > \n> > I don't think stripping them out is the right thing either, hiding\n> > from you that something is Really Wrong (binary garbage in patches)\n> > isn't good.\n> > \n> > Something like this would be better:\n> > \n> > s/([[:cntrl:]])/sprintf(\"\\\\%03x\", ord $1)/ge\n> \n> Or \n> s|([[:cntrl:]])|quot_cec($1)|eg;\n> \n> But is it worth it? This is about _title_ attribute, shown only on \n> mouseover (mouse hover).\n> \n> \n> But perhaps it would be worth it to add 'prep_attr' and 'esc_attr'\n> functions, though esc_html can be used in those places where esc_attr\n> would be needed...\nIs there something I can do to bring this forward? (I assume this isn't\nfixed yet, at least it isn't in Debian's 1.7.2.3 package.)\n\nBest regards\nUwe\n\n\n-- \nPengutronix e.K. | Uwe Kleine-König |\nIndustrial Linux Solutions | http://www.pengutronix.de/ |\n"}]}