git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] gitweb: protect blob and diff output lines from controls.

From
Jakub Narebski <jnareb@gmail.com>
Date
Nov 9, 2006, 09:24 UTC
Message-ID
<200611091024.35019.jnareb@gmail.com>
In-Reply-To
<200611090104.32247.jnareb@gmail.com>
Jakub Narebski wrote:
> I'm not sure what quoting to choose for esc_attr, but there we could
> use even --no-control-chars quoting (replacing any control character
> by '?');  but perhaps in some cases like git_print_page_path
> subroutine CEC is better.

I'm rambling. esc_attr is special case, because CGI does escapeHTML (and I hope also to_utf8) for us. Using <span class="cntrl">...</span> has also no sense. So there should be separate esc_attr_path subroutine I think.

Even if we decide that esc_html and esc_path should give identical output (the difference that _might_ be here is that in esc_html we don't need to escape whitespace control characters valid in HTML, like tab (HT, TAB) or newline (LF); on the other hand thanks to line-by-line processing we should never get newline in "blob", and thanks to untabify we should never get tab in "blob") I think it would be prudent to have esc_path, even as thin wrapper just caling esc_html.

We might decide to use different style for control characters in different views, but that I think can be done using pure CSS.

-- 
Jakub Narebski
Previous: Jakub NarebskiNext: Junio C Hamano
Message 7 of 12 in “gitweb: protect blob and diff output lines from controls.”
  1. gitweb: protect blob and diff output lines from controls.Junio C Hamano, Nov 8, 2006
  2. Jakub NarebskiNov 9, 2006
  3. Junio C HamanoNov 9, 2006
  4. Jakub NarebskiNov 9, 2006
  5. Junio C HamanoNov 9, 2006
  6. Jakub NarebskiNov 9, 2006
  7. Jakub NarebskiNov 9, 2006
  8. Junio C HamanoNov 9, 2006
  9. Jakub NarebskiNov 9, 2006
  10. Junio C HamanoNov 9, 2006
  11. Jakub NarebskiNov 9, 2006
  12. Luben TuikovNov 10, 2006

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.