git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 4/n] gitweb: Secure against commit-ish/tree-ish with the same name as path

From
Jakub Narebski <jnareb@gmail.com>
Date
Nov 1, 2006, 00:40 UTC
Message-ID
<200611010140.56834.jnareb@gmail.com>
In-Reply-To
<7vejsoovxu.fsf@assigned-by-dhcp.cox.net>
Junio C Hamano wrote:
> 
> To be honest, I dislike these */n series where the the end is
> unknown.  It just confuses me what's still surviving, what's
> already shot down, and what's being rerolled.
Well, it looks like this patch series is closing to final patch.
The "New improved patchset view" is done.
Show 7 quoted lines
> Let's step back a bit and see if we share the same view as to
> the status of each one:
> 
> [PATCH/RFC 1/n] gitweb: Better git-unquoting and gitweb-quoting of p...
> 
> Marked preliminary, perhaps need some discussion and rerolling
> but I haven't looked at it.

I'm not sure if without this patch (well, the unquote part) gitweb can work with filenames which git quotes using escape sequences, like ", \, LF, TAB. Former version didn't unquote fully, and it passed partially unquoted filename to git.

> [PATCH 2/n] gitweb: Use '&iquot;' instead of '?' in esc_path
> 
> Discussed; we agreed that showing byte values in different
> colors is preferable.  Waiting for re-roll.

The problem with using text color or background color is that the filenames tends to be shown with different color and background color: "tree" view, parts of difftree, parts of diff header, etc. Perhaps text-decoration: overline;? Just kidding...

Show 7 quoted lines
> [PATCH 3/n] gitweb: Use 's' regexp modifier to secure against filena...
> 
> I looked at it although haven't said anything yet.  Probably a
> safe and good change but I wonder how LF at the end of the line
> matches /...(.+)$/s pattern; iow, if we do not use -z does it
> still do the right thing?  Otherwise I suspect you would perhaps
> need to chomp?

We always pass chomped lines. First chunk is unnecessary (we care only for type), without second "tree" view look strange for files with embedded newline in filename.

> [PATCH 4/n] gitweb: Secure against commit-ish/tree-ish with the same...
> 
> Good fix and even improves readability; will apply after
> dropping -- from ls-tree args.

As I said, noticed while testing gitweb with strange filenames in 'gitweb/test' branch.

Show 7 quoted lines
> [PATCH 5/n] [take 3] gitweb: New improved patchset view
> [PATCH 6/n] gitweb: Remove redundant "blob" links from git_difftree_...
> [PATCH 7/n] gitweb: Output also empty patches in "commitdiff" view
> [PATCH 8/n] gitweb: Fix two issues with quoted filenames in git_patc...
> 
> Haven't looked at them and I do not think people have had enough
> time to comment on them yet.
Well, patch 5 and 8 could be collapsed.
-- 
Jakub Narebski
Previous: Junio C HamanoNext: Junio C Hamano
Message 28 of 46 in “gitweb: Better quoting and New improved patchset view”
  1. gitweb: Better quoting and New improved patchset viewJakub Narebski, Oct 30, 2006
  2. gitweb: Better git-unquoting and gitweb-quoting of pathnamesJakub Narebski, Oct 30, 2006
  3. Junio C HamanoNov 3, 2006
  4. Jakub NarebskiNov 3, 2006
  5. Junio C HamanoNov 3, 2006
  6. Jakub NarebskiNov 3, 2006
  7. gitweb: Use '&iquot;' instead of '?' in esc_pathJakub Narebski, Oct 30, 2006
  8. Junio C HamanoOct 31, 2006
  9. Junio C HamanoOct 31, 2006
  10. Jakub NarebskiOct 31, 2006
  11. Jakub NarebskiNov 3, 2006
  12. Junio C HamanoNov 3, 2006
  13. Jakub NarebskiNov 3, 2006
  14. Junio C HamanoNov 3, 2006
  15. Petr BaudisNov 3, 2006
  16. Jakub NarebskiNov 3, 2006
  17. Junio C HamanoNov 4, 2006
  18. Petr BaudisNov 4, 2006
  19. Jakub NarebskiNov 6, 2006
  20. Junio C HamanoNov 6, 2006
  21. Jakub NarebskiNov 6, 2006
  22. Jakub NarebskiNov 7, 2006
  23. Junio C HamanoNov 7, 2006
  24. gitweb: Use 's' regexp modifier to secure against filenames with LFJakub Narebski, Oct 30, 2006
  25. gitweb: Secure against commit-ish/tree-ish with the same name as pathJakub Narebski, Oct 30, 2006
  26. Jakub NarebskiOct 31, 2006
  27. Junio C HamanoNov 1, 2006
  28. Jakub NarebskiNov 1, 2006
  29. Junio C HamanoNov 2, 2006
  30. Jakub NarebskiNov 2, 2006
  31. Junio C HamanoNov 3, 2006
  32. Junio C HamanoNov 3, 2006
  33. Jakub NarebskiNov 3, 2006
  34. [take 3] gitweb: New improved patchset viewJakub Narebski, Oct 31, 2006
  35. 5/10 gitweb: New improved patchset viewJakub Narebski, Nov 3, 2006
  36. gitweb: Remove redundant "blob" links from git_difftree_bodyJakub Narebski, Oct 31, 2006
  37. Junio C HamanoNov 3, 2006
  38. Jakub NarebskiNov 3, 2006
  39. gitweb: Output also empty patches in "commitdiff" viewJakub Narebski, Oct 31, 2006
  40. Jakub NarebskiNov 3, 2006
  41. gitweb: Fix two issues with quoted filenames in git_patchset_bodyJakub Narebski, Oct 31, 2006
  42. gitweb: Better support for non-CSS aware web browsersJakub Narebski, Nov 1, 2006
  43. Petr BaudisNov 1, 2006
  44. gitweb: New improved formatting of chunk header in diffJakub Narebski, Nov 1, 2006
  45. Jakub NarebskiNov 1, 2006
  46. Jakub NarebskiNov 7, 2006

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.