From: Shawn O. Pearce <spearce@spearce.org>
Date: Sun, 21 Oct 2007 03:25:33 GMT
Subject: Re: [PATCH] gitweb: Provide title attributes for abbreviated author names.
Message-ID: <20071021032533.GA30717@spearce.org>
In-Reply-To: <1192581277533-git-send-email-dsymonds@gmail.com>

Nice, but...

David Symonds <dsymonds@gmail.com> wrote:
> +++ b/gitweb/gitweb.perl
> @@ -3461,9 +3461,15 @@ sub git_shortlog_body {
>  			print "<tr class=\"light\">\n";
>  		}
>  		$alternate ^= 1;
> +		my $author = chop_str($co{'author_name'}, 10);
> +		if ($author ne $co{'author_name'}) {
> +			$author = "<span title=\"$co{'author_name'}\">" . esc_html($author) . "</span>";

Doesn't this produce invalid HTML if $co{'author_name'} has a special
HTML character in it such as & or "?  Note that " is much more likely
as it is often used for nicknames.  The old code properly escaped
the author name, and indeed you are doing it for the abbreviated
version but not the full version.

This bug seemed to exist in almost all (if not all) of the hunks.

-- 
Shawn.