From: Jakub Narebski Date: Fri, 22 May 2009 15:39:32 GMT Subject: [PATCH (lite)] gitweb: Sanitize title attribute in format_subject_html Message-ID: <200905221739.35254.jnareb@gmail.com> In-Reply-To: <200905221735.48310.jnareb@gmail.com> Replace control characters with question mark '?' (like in chop_and_esc_str). While at it: chop_and_escape_str doesn't need capturing group. Noticed-by: Paul Gortmaker Signed-off-by: Jakub Narebski --- This version has more sane ratio of commit message length to actual change... gitweb/gitweb.perl | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl index 05702e4..1e7e2d8 100755 --- a/gitweb/gitweb.perl +++ b/gitweb/gitweb.perl @@ -1236,7 +1236,7 @@ sub chop_and_escape_str { if ($chopped eq $str) { return esc_html($chopped); } else { - $str =~ s/([[:cntrl:]])/?/g; + $str =~ s/[[:cntrl:]]/?/g; return $cgi->span({-title=>$str}, esc_html($chopped)); } } @@ -1459,6 +1459,7 @@ sub format_subject_html { $extra = '' unless defined($extra); if (length($short) < length($long)) { + $long =~ s/[[:cntrl:]]/?/g; return $cgi->a({-href => $href, -class => "list subject", -title => to_utf8($long)}, esc_html($short) . $extra); -- 1.6.3.1