Re: Rss produced by git is not valid xml?

From: H. Peter Anvin <hpa@zytor.com>
Date: Nov 18, 2005, 20:55 UTC
Message-ID: <437E3FC1.2040307@zytor.com>
In-Reply-To: <Pine.LNX.4.64.0511181237040.13959@g5.osdl.org>

Linus Torvalds wrote:

Show 10 quoted lines

> 
> Which is a fine option. Latin-1 is probably the right choice for the 
> kernel, but not necessarily for other projects.
> 
> Another option is to just pass them through unmodified, and encourage the 
> XML parser to handle it. Anything that takes UTF-8 and doesn't have some 
> fallback to handle malformed input is basically buggy. It simply _will_ 
> happen occasionally, quite independently of git.  You can either give up, 
> or try to handle it. And giving up is always the wrong choice.
>

Not necessarily. If you can't guarantee that you won't do something that's bad for security, giving up is the only valid choice.

The problem, of course, comes into place when people write generic XML parsers -- or, for that matter, UTF-8 decoders -- and don't know what will happen to the data downstream. Trying to make invalid data valid has the same problems as DWIM (after all, it *is* DWIM): if done on the wrong side of a security barrier it has unpredictable consequences.

Thus, making gitweb -- a producer application -- do the guessing is probably the right thing.

Sorry, Mr. Protocol; in this malware-infested world the old adage "be liberal in what you accept, conservative in what you send" unfortunately has had to be modified.

	-hpa