Re: [PATCH] gitweb: filter escapes from longer commit titles that break firefox

> Jakub Narebski wrote:
>> Paul Gortmaker <paul.gortmaker@windriver.com> writes:
>>
>>   
>>> If there is a commit that ends in ^X and is longer in length than
>>> what will fit in title_short, then it doesn't get fed through
>>> esc_html() and so the ^X will appear as-is in the page source.
>>>
>>> When Firefox comes across this, it will fail to display the page,
>>> and only display a couple lines of error messages that read like:
>>>
>>>    XML Parsing Error: not well-formed
>>>    Location: http://git ....
>>>
>>> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>

>> But I do not think that the solution presented here is good solution
>> for this problem.  chop_and_escape_str is meant as _output_ filter,
>> because it generates (can generate) fragment of HTML.  It is not a
>> good solution to use it for shortening in intermediate representation
>> of %co{'title'}.
>>
>> And I think that issue might be a bug elsewhere in gitweb if we have
>> text output which is not passed through esc_html... or bug in CGI.pm
>> if the error is in not escaping of -title _attribute_ (attribute
>> escaping has slightly different rules than escaping HTML, and should
>> be done automatically by CGI.pm).
>>
>>
>> So thanks for noticing the issue, but NAK on the solution.
> 
> Fair enough -- I wasn't familiar with the code in there, and there 
> wasn't really any indication that it was for output only.  I can easily 
> believe that there is a better place for it -- I just didn't see where 
> any global esc_html filtering was taking place...