From: Jakub Narebski <jnareb@gmail.com>
Date: Fri, 26 Aug 2011 22:06:18 GMT
Subject: Re: [PATCH] gitweb: highlight: strip non-printable characters via col(1)
Message-ID: <201108270006.19289.jnareb@gmail.com>
In-Reply-To: <7v8vqfdf0l.fsf@alter.siamese.dyndns.org>

On Fri, 26 Aug 2011, Junio C Hamano wrote:
> Jakub Narebski <jnareb@gmail.com> writes:
> 
> > Why use external program (which ming be not installed, or might not
> > strip control-characters), instead of making gitweb sanitize highlighter
> > output itself.  Something like the patch below (which additionally
> > shows where there are control characters):
> 
> I agree that that would be a more sensible approach. What does your sample
> code below do to a HT by the way?

Actually the line earlier

 			$line = untabify($line);

replaces HT ("\t") with spaces.

> > -- >8 --
> > diff --git i/gitweb/gitweb.perl w/gitweb/gitweb.perl
> > index 7cf12af..192db2c 100755
> > --- i/gitweb/gitweb.perl
> > +++ w/gitweb/gitweb.perl
> > @@ -1517,6 +1517,17 @@ sub esc_path {
> >  	return $str;
> >  }
> >  
> > +# Sanitize for use in XHTML + application/xml+xhtml
> > +sub sanitize {
> > +	my $str = shift;
> > +
> > +	return undef unless defined $str;
> > +
> > +	$str = to_utf8($str);
> > +	$str =~ s|([[:cntrl:]])|quot_cec($1)|eg;
> > +	return $str;
> > +}

Anyway, it could well be

+	$str =~ s|([[:cntrl:]])|(($1 ne "\t") ? quot_cec($1) : $1)|eg;
+	return $str;

like in esc_html rather than like in esc_path.

> > @@ -6546,7 +6557,8 @@ sub git_blob {
> >  			$nr++;
> >  			$line = untabify($line);
                        ^^^^^^^^^^^^^^^^^^^^^^^^

> >  			printf qq!<div class="pre"><a id="l%i" href="%s#l%i" class="linenr">%4i</a> %s</div>\n!,
> > -			       $nr, esc_attr(href(-replay => 1)), $nr, $nr, $syntax ? to_utf8($line) : esc_html($line, -nbsp=>1);
> > +			       $nr, esc_attr(href(-replay => 1)), $nr, $nr,
> > +			       $syntax ? sanitize($line) : esc_html($line, -nbsp=>1);
> >  		}
> >  	}
> >  	close $fd

-- 
Jakub Narebski
Poland