Re: gitweb not friendly to firefox revived

From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Aug 14, 2010, 10:48 UTC
Message-ID: <AANLkTimR9Wkz+YOchyjvO8fgAwk5YsGtcpMOpyZY4Fjv@mail.gmail.com>
In-Reply-To: <4C6670EE.3060806@gmail.com>

2010/8/14 Stephen Boyd <bebarino@gmail.com>:

Show 14 quoted lines

>  On 08/03/2010 02:50 PM, Jakub Narebski wrote:
>>
>> +
>> +       my $title = to_utf8("Search for commits $performed by $author");
>> +       $title =~ s/[[:cntrl:]]/?/g;
>> +
>>
>
> Isn't it possible that other data coming from git could have escape
> characters in them such as the commit subject line? In which case this same
> bug would occur?
>
> Therefore isn't it better to strip out control characters (that's what this
> patch is doing right?) in esc_html?

I don't think stripping them out is the right thing either, hiding from you that something is Really Wrong (binary garbage in patches) isn't good.

Something like this would be better:

    s/([[:cntrl:]])/sprintf("\\%03x", ord $1)/ge

E.g.:

    $ perl -E 'my $s = join "", map { chr } 1 .. 40; $s =~
s/([[:cntrl:]])/sprintf("\\%03x", ord $1)/ge; say $s'
    \001\002\003\004\005\006\007\008\009\00a\00b\00c\00d\00e\00f\010\011\012\013\014\015\016\017\018\019\01a\01b\01c\01d\01e\01f
!"#$%&'(