From: Jeff King <peff@peff.net>
Date: Tue, 06 Mar 2007 10:56:29 GMT
Subject: Re: [PATCH] gitweb: Change to use explicitly function call cgi->escapHTML()
Message-ID: <20070306105629.GA13285@coredump.intra.peff.net>
In-Reply-To: <7vveheprsc.fsf@assigned-by-dhcp.cox.net>

On Tue, Mar 06, 2007 at 02:53:07AM -0800, Junio C Hamano wrote:

> But then you are letting _other_ mod_perl users to affect your
> behaviour, aren't you?  "sub autoEscape" does this:

Yes (but I don't know how mod_perl works, and I haven't been able to
find a simple answer by skimming the docs).

> If we worry about mod_perl (provided if $CGI::Q is shared across
> mod_perl users), I suspect we would need to be a bit more
> paranoid, perhaps like this, woudln't we?
> [...]
> +$cgi->autoEscape(1);

That rebreaks the original problem, though. Calling escapeHTML doesn't
look at $cgi, it looks at $Q (the "default" CGI object). I believe
escape is _already_ set to 1 for $cgi (which is why the $cgi->escapeHTML
patch worked).

-Peff