{"thread":{"id":"29039","subject":"[PATCH] gitweb: Escape attribute in chop_and_escape_str()","startedAt":"2011-11-28T23:27:34Z","lastAt":"2011-11-29T19:33:39Z","messageCount":2,"participants":["Jürgen Kreileder","Jakub Narebski"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"180068","messageId":"CAKD0UuyOMRFHE6DvuDj0ancfwFfg8ADKab6emv99+FN5RfZ=mQ@mail.gmail.com","threadId":"29039","inReplyTo":null,"subject":"[PATCH] gitweb: Escape attribute in chop_and_escape_str()","fromName":"Jürgen Kreileder","fromEmail":"jk@blackdown.de","sentAt":"2011-11-28T23:27:34Z","receivedAt":"2011-11-28T23:27:34Z","isPatch":true,"sender":{"key":"jk@blackdown.de","avatar":"https://avatars.githubusercontent.com/u/4390544?v=4"},"body":"Fixes the title attribute in <span title=\"Jürgen Kreileder\">Jürgen\nKreileder</span>\nfor example because to_utf8() is called implicitly now.\n\n(Not sure why the attribute is there at all in the example. From my\npoint of view\nnothing got chopped.)\n\nSigned-off-by: Juergen Kreileder <jk@blackdown.de>\n---\n gitweb/gitweb.perl |    2 +-\n 1 files changed, 1 insertions(+), 1 deletions(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex 4f0c3bd..fd76407 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -1699,7 +1699,7 @@ sub chop_and_escape_str {\n \t\treturn esc_html($chopped);\n \t} else {\n \t\t$str =~ s/[[:cntrl:]]/?/g;\n-\t\treturn $cgi->span({-title=>$str}, esc_html($chopped));\n+\t\treturn $cgi->span({-title => esc_attr($str)}, esc_html($chopped));\n \t}\n }\n\n-- \n1.7.5.4\n"},{"id":"180104","messageId":"m3liqylo5u.fsf@localhost.localdomain","threadId":"29039","inReplyTo":"CAKD0UuyOMRFHE6DvuDj0ancfwFfg8ADKab6emv99+FN5RfZ=mQ@mail.gmail.com","subject":"Re: [PATCH] gitweb: Escape attribute in chop_and_escape_str()","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2011-11-29T19:33:39Z","receivedAt":"2011-11-29T19:33:39Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Jürgen Kreileder <jk@blackdown.de> writes:\n\n> Fixes the title attribute in <span title=\"Jürgen Kreileder\">Jürgen\n> Kreileder</span> for example because to_utf8() is called implicitly now.\n> \n> (Not sure why the attribute is there at all in the example. From my\n> point of view nothing got chopped.)\n\nHmmm... this should not happen because of\n\n\tmy $chopped = chop_str(@_);\n\tif ($chopped eq $str) {\n\t\treturn esc_html($chopped);\n\t} else \n \nPerhaps it is a matter of doing to_utf8() on $str prior to comparison?\n\n> Signed-off-by: Juergen Kreileder <jk@blackdown.de>\n> ---\n>  gitweb/gitweb.perl |    2 +-\n>  1 files changed, 1 insertions(+), 1 deletions(-)\n> \n> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\n> index 4f0c3bd..fd76407 100755\n> --- a/gitweb/gitweb.perl\n> +++ b/gitweb/gitweb.perl\n> @@ -1699,7 +1699,7 @@ sub chop_and_escape_str {\n>  \t\treturn esc_html($chopped);\n>  \t} else {\n>  \t\t$str =~ s/[[:cntrl:]]/?/g;\n> -\t\treturn $cgi->span({-title=>$str}, esc_html($chopped));\n> +\t\treturn $cgi->span({-title => esc_attr($str)}, esc_html($chopped));\n>  \t}\n>  }\n> \n> -- \n\nesc_attr() is a wrong solution here, because $cgi->span(...) should\nproperly escape attributes.  You should simply use to_utf8() or\nsanitize().\n\nWell, uless we simply do\n\n  $str = to_utf8($str);\n\nearlier.\n\n-- \nJakub Narębski\n"}]}