Re: [PATCH (bugfix)] gitweb: Add and use prep_attr helper

From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Sep 15, 2010, 20:40 UTC
Message-ID: <AANLkTi=o2PFB=JkO5wYHCLAHCO=Ebe63mAc6WB8GfktH@mail.gmail.com>
In-Reply-To: <201009152234.14253.jnareb@gmail.com>

2010/9/15 Jakub Narebski <jnareb@gmail.com>:

Show 11 quoted lines

> One of features of CGI.pm module is HTML generation.  The HTML
> generation subroutines / methods automatically escape values of
> attributes of HTML elements... but in older versions didn't do it
> fully, not removing / replacing control characters.  Control
> characters are forbidden in XML / XHTML, and some browsers
> (e.g. Firefox) do not skip over them but display error instead of page
> in strict XHTML mode (XHTML DTD + application/xml+html mimetype).
>
> This issue was noticed by Uwe Kleine-König and resolved to be a
> problem with control characters in XHTML output by Ævar Arnfjörð
> Bjarmason in format_search_author() subroutine.

FWIW this looks good to me, but perhaps instead of using "?" for everything in ASCII from \0 to " " it would be better to display the human-readable escape sequence, like "\r" or "\b".

Gitweb already does this (although I don't have a link handy) if you check in a file with Windows newlines, it'll display "\r" in a little box.

Maybe that should be done everywhere? I don't know.