[PATCH] Prevent purely-numeric ref names from breaking Javascript.

David Symonds· Oct 1, 2007, 15:37 UTC · lore

When the server reply carrying JSON data to the client browser to render has
a string that looks like a decimal number, it doesn't get quoted. The
client-side Javascript code assumes, however, that all the ref names are
strings, and so calls string functions on decimal number objects if the ref
name is purely numeric (e.g. "2.5"). This patch simply forces the objects that
are escaped for HTML presentation to be coerced into strings, which catches
this case (and possibly others).
---
 by-commit.html |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

Show changes to by-commit.html +1 −0

diff --git a/by-commit.html b/by-commit.html
index d759c3e..0aa69b9 100644
--- a/by-commit.html
+++ b/by-commit.html
@@ -35,6 +35,7 @@ format_log_date=function( date )
 }
 escape_html=function( s )
 {
+	s=s+"";	// ensure it's a string
 	s=s.replace( /\&/g, "&amp;" );
 	s=s.replace( /\</g, "&lt;" );
 	s=s.replace( /\>/g, "&gt;" );

-- 
1.5.3.1

patchPrevent purely-numeric ref names from breaking Javascript.