Re: [PATCH 4/n] gitweb: Secure against commit-ish/tree-ish with the same name as path

From: Jakub Narebski <jnareb@gmail.com>
Date: Nov 2, 2006, 08:49 UTC
Message-ID: <200611020949.34276.jnareb@gmail.com>
In-Reply-To: <7vac3awtj4.fsf@assigned-by-dhcp.cox.net>

Junio C Hamano wrote:

Show 5 quoted lines

> I'll be pushing out a "master" update
> sometime today, and do not expect to be able to get to your "n
> turned out to be ten" series, so it might be worthwhile to
> reroll the remaining bits that you still care about on top of
> what I push out tonight to make sure we are on the same page.

I'll wait a while if there are any comments (for example on formatting used), and resend cleaned-up series.

> Preferably:
>
>  - you should avoid making a series out of more-or-less
>    unrelated things;

Well, truly unrelated were adding "--" to secure against ref with the same name as path in the repository (but it was discovered during testing the series) and replacing ' ' with ' ' in blob and diff body for non-CSS aware browsers.

Better quoting and unquoting was needed for better commitdiff view. Ah, well, perhaps it is unrelated.

Securing against filenames with LF for example has sense only if there can be filenames with LF, and earlier gitweb unquoted it halfway leaving '\n' instead of LF.

>  - if you are doing related things in one series, do not send
>    half-baked early parts out until you are finished and are
>    confident with it.

I've send series early to get some comments, but I see while I got some comments on "take 1" and "take 2" on _single_ "new commitdiff" RFC patch, I got comments only about half-baked '&iquot;' idea.

-- 
Jakub Narebski