From: Junio C Hamano <gitster@pobox.com>
Date: Fri, 26 Aug 2011 21:44:26 GMT
Subject: Re: [PATCH] gitweb: highlight: strip non-printable characters via col(1)
Message-ID: <7v8vqfdf0l.fsf@alter.siamese.dyndns.org>
In-Reply-To: <201108262154.14493.jnareb@gmail.com>

Jakub Narebski <jnareb@gmail.com> writes:

> Why use external program (which ming be not installed, or might not
> strip control-characters), instead of making gitweb sanitize highlighter
> output itself.  Something like the patch below (which additionally
> shows where there are control characters):

I agree that that would be a more sensible approach. What does your sample
code below do to a HT by the way?

> -- >8 --
> diff --git i/gitweb/gitweb.perl w/gitweb/gitweb.perl
> index 7cf12af..192db2c 100755
> --- i/gitweb/gitweb.perl
> +++ w/gitweb/gitweb.perl
> @@ -1517,6 +1517,17 @@ sub esc_path {
>  	return $str;
>  }
>  
> +# Sanitize for use in XHTML + application/xml+xhtml
> +sub sanitize {
> +	my $str = shift;
> +
> +	return undef unless defined $str;
> +
> +	$str = to_utf8($str);
> +	$str =~ s|([[:cntrl:]])|quot_cec($1)|eg;
> +	return $str;
> +}
> +
>  # Make control characters "printable", using character escape codes (CEC)
>  sub quot_cec {
>  	my $cntrl = shift;
> @@ -6546,7 +6557,8 @@ sub git_blob {
>  			$nr++;
>  			$line = untabify($line);
>  			printf qq!<div class="pre"><a id="l%i" href="%s#l%i" class="linenr">%4i</a> %s</div>\n!,
> -			       $nr, esc_attr(href(-replay => 1)), $nr, $nr, $syntax ? to_utf8($line) : esc_html($line, -nbsp=>1);
> +			       $nr, esc_attr(href(-replay => 1)), $nr, $nr,
> +			       $syntax ? sanitize($line) : esc_html($line, -nbsp=>1);
>  		}
>  	}
>  	close $fd
>
> -- 8< --