{"thread":{"id":"42961","subject":"[PATCH] gitweb: escape link body in format_ref_marker","startedAt":"2016-07-29T14:49:42Z","lastAt":"2016-08-02T10:25:32Z","messageCount":4,"participants":["Andreas Brauchli","Jakub Narębski","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"292514","messageId":"CABnoAVcUbmvZbu7ZiEUWtq_2P6RQLVnJx1a-PiLW-r8uWQ+5vw@mail.gmail.com","threadId":"42961","inReplyTo":null,"subject":"[PATCH] gitweb: escape link body in format_ref_marker","fromName":"Andreas Brauchli","fromEmail":"a.brauchli@elementarea.net","sentAt":"2016-07-29T14:49:37Z","receivedAt":"2016-07-29T14:49:42Z","isPatch":true,"sender":{"key":"a.brauchli@elementarea.net","avatar":null},"body":"Fix a case where an html link can be generated from unescaped input\nresulting in invalid strict xhtml or potentially injected code.\n\nAn overview of a repo with a tag \"1.0.0&0.0.1\" would previously result\nin an unescaped amperstand in the link body.\n\nSigned-off-by: Andreas Brauchli \n---\n gitweb/gitweb.perl | 2 +-\n 1 file changed, 1 insertion(+), 1 deletion(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex 2fddf75..33d701d 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -2090,7 +2090,7 @@ sub format_ref_marker {\n -href => href(\n action=>$dest_action,\n hash=>$dest\n- )}, $name);\n+ )}, esc_html($name));\n\n $markers .= \" \" .\n $link . \"\";\n-- \n2.7.4\n"},{"id":"292654","messageId":"51785fbd-6858-c9b2-7f59-eaf7bd3ea394@gmail.com","threadId":"42961","inReplyTo":"CABnoAVcUbmvZbu7ZiEUWtq_2P6RQLVnJx1a-PiLW-r8uWQ+5vw@mail.gmail.com","subject":"Re: [PATCH] gitweb: escape link body in format_ref_marker","fromName":"Jakub Narębski","fromEmail":"jnareb@gmail.com","sentAt":"2016-07-30T17:46:39Z","receivedAt":"2016-07-30T17:47:05Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"W dniu 29.07.2016 o 16:49, Andreas Brauchli pisze:\n> Fix a case where an html link can be generated from unescaped input\n> resulting in invalid strict xhtml or potentially injected code.\n> \n> An overview of a repo with a tag \"1.0.0&0.0.1\" would previously result\n> in an unescaped amperstand in the link body.\n\ns/amperstand/ampersand/\n ^---------------- [ spurious 't' ]\n\nUnescaped ampersand would cause trouble if gitweb output is in XHTML\nmode, as some web browsers are strict about validating XML, and do not\ndisplay anything (note: this detail is unnecessary in the commit\nmessage).\n\nI guess that \"1.0.0&0.0.1\" tags are something encountered in real\nrepositories, while \"12\" would be just something evil...\n\n> \n> Signed-off-by: Andreas Brauchli \n\nGood catch!\n\nAcked-by: Jakub Narębski \n\n> ---\n> gitweb/gitweb.perl | 2 +-\n> 1 file changed, 1 insertion(+), 1 deletion(-)\n> \n> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\n> index 2fddf75..33d701d 100755\n> --- a/gitweb/gitweb.perl\n> +++ b/gitweb/gitweb.perl\n> @@ -2090,7 +2090,7 @@ sub format_ref_marker {\n> -href => href(\n> action=>$dest_action,\n> hash=>$dest\n> - )}, $name);\n> + )}, esc_html($name));\n> \n> $markers .= \" class=\\\"\".esc_attr($class).\"\\\" title=\\\"\".esc_attr($ref).\"\\\">\" .\n> $link . \"\";\n> \n\n"},{"id":"292791","messageId":"xmqq37mojme2.fsf@gitster.mtv.corp.google.com","threadId":"42961","inReplyTo":"51785fbd-6858-c9b2-7f59-eaf7bd3ea394@gmail.com","subject":"Re: [PATCH] gitweb: escape link body in format_ref_marker","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2016-08-01T19:54:13Z","receivedAt":"2016-08-01T20:50:44Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jakub Narębski writes:\n\n> Good catch!\n>\n> Acked-by: Jakub Narębski \n\nSigh; the contents may be good but the patch is unusable as-is\nbecause of heavy whitespace damage.\n\nI'll fix it up. Thanks, both.\n\n>> ---\n>> gitweb/gitweb.perl | 2 +-\n>> 1 file changed, 1 insertion(+), 1 deletion(-)\n>> \n>> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\n>> index 2fddf75..33d701d 100755\n>> --- a/gitweb/gitweb.perl\n>> +++ b/gitweb/gitweb.perl\n>> @@ -2090,7 +2090,7 @@ sub format_ref_marker {\n>> -href => href(\n>> action=>$dest_action,\n>> hash=>$dest\n>> - )}, $name);\n>> + )}, esc_html($name));\n>> \n>> $markers .= \" > class=\\\"\".esc_attr($class).\"\\\" title=\\\"\".esc_attr($ref).\"\\\">\" .\n>> $link . \"\";\n>> \n"},{"id":"292825","messageId":"CABnoAVemROJ7YN22gthqoCcDa8JsAJuQ9v+oD+-vw7ocyfHAeg@mail.gmail.com","threadId":"42961","inReplyTo":"xmqq37mojme2.fsf@gitster.mtv.corp.google.com","subject":"Re: [PATCH] gitweb: escape link body in format_ref_marker","fromName":"Andreas Brauchli","fromEmail":"a.brauchli@elementarea.net","sentAt":"2016-08-02T10:25:26Z","receivedAt":"2016-08-02T10:25:32Z","isPatch":true,"sender":{"key":"a.brauchli@elementarea.net","avatar":null},"body":"On Mon, Aug 1, 2016 at 9:54 PM, Junio C Hamano wrote:\n> Jakub Narębski writes:\n>\n>> Good catch!\n>>\n>> Acked-by: Jakub Narębski \n>\n> Sigh; the contents may be good but the patch is unusable as-is\n> because of heavy whitespace damage.\n>\n> I'll fix it up. Thanks, both.\nMy apologies for that, it seems that gmail doesn't do tabs.\nI resubmitted the PR as #283 on GitHub along with Jakub's Ack and\nfixed the typo he pointed out in the commit message\n\nhttps://github.com/git/git/pull/283\n\nKind regards\nandreas\n\n>\n>>> ---\n>>> gitweb/gitweb.perl | 2 +-\n>>> 1 file changed, 1 insertion(+), 1 deletion(-)\n>>>\n>>> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\n>>> index 2fddf75..33d701d 100755\n>>> --- a/gitweb/gitweb.perl\n>>> +++ b/gitweb/gitweb.perl\n>>> @@ -2090,7 +2090,7 @@ sub format_ref_marker {\n>>> -href => href(\n>>> action=>$dest_action,\n>>> hash=>$dest\n>>> - )}, $name);\n>>> + )}, esc_html($name));\n>>>\n>>> $markers .= \" >> class=\\\"\".esc_attr($class).\"\\\" title=\\\"\".esc_attr($ref).\"\\\">\" .\n>>> $link . \"\";\n>>>\n"}]}