From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Wed, 15 Sep 2010 20:40:41 GMT
Subject: Re: [PATCH (bugfix)] gitweb: Add and use prep_attr helper
Message-ID: <AANLkTi=o2PFB=JkO5wYHCLAHCO=Ebe63mAc6WB8GfktH@mail.gmail.com>
In-Reply-To: <201009152234.14253.jnareb@gmail.com>

2010/9/15 Jakub Narebski <jnareb@gmail.com>:
> One of features of CGI.pm module is HTML generation.  The HTML
> generation subroutines / methods automatically escape values of
> attributes of HTML elements... but in older versions didn't do it
> fully, not removing / replacing control characters.  Control
> characters are forbidden in XML / XHTML, and some browsers
> (e.g. Firefox) do not skip over them but display error instead of page
> in strict XHTML mode (XHTML DTD + application/xml+html mimetype).
>
> This issue was noticed by Uwe Kleine-König and resolved to be a
> problem with control characters in XHTML output by Ævar Arnfjörð
> Bjarmason in format_search_author() subroutine.

FWIW this looks good to me, but perhaps instead of using "?" for
everything in ASCII from \0 to " " it would be better to display the
human-readable escape sequence, like "\r" or "\b".

Gitweb already does this (although I don't have a link handy) if you
check in a file with Windows newlines, it'll display "\r" in a little
box.

Maybe that should be done everywhere? I don't know.