[PATCH] Don't open a XML tag while another one is already open

Robert Schiele· Feb 16, 2008, 19:16 UTC · lore

chop_and_escape_str calls esc_html within a XML tag. Since esc_html itself does escape control characters with quot_cec it could potentially open another tag which leads to incorrect XML.

This patch adds an option "intag" to esc_html and quot_cec to indicate that we are currently within a tag and thus suppresses opening another one. It also makes use of this option in chop_and_escape_str.

Signed-off-by: Robert Schiele <rschiele@gmail.com>
---
This patch should fix the bug Martin Koegler reported in his mail "Invalid
html output repo.or.cz (alt-git.git)".

 gitweb/gitweb.perl |   11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)

Show changes to gitweb/gitweb.perl +8 −3

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 5e88637..a010c7a 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -732,7 +732,7 @@ sub esc_html ($;%) {
 	if ($opts{'-nbsp'}) {
 		$str =~ s/ /&nbsp;/g;
 	}
-	$str =~ s|([[:cntrl:]])|(($1 ne "\t") ? quot_cec($1) : $1)|eg;
+	$str =~ s|([[:cntrl:]])|(($1 ne "\t") ? quot_cec($1, -intag=>$opts{'-intag'}) : $1)|eg;
 	return $str;
 }
 
@@ -753,6 +753,7 @@ sub esc_path {
 # Make control characters "printable", using character escape codes (CEC)
 sub quot_cec {
 	my $cntrl = shift;
+	my %opts = @_;
 	my %es = ( # character escape codes, aka escape sequences
 		   "\t" => '\t',   # tab            (HT)
 		   "\n" => '\n',   # line feed      (LF)
@@ -767,7 +768,11 @@ sub quot_cec {
 	my $chr = ( (exists $es{$cntrl})
 		    ? $es{$cntrl}
 		    : sprintf('\%03o', ord($cntrl)) );
-	return "<span class=\"cntrl\">$chr</span>";
+	if ($opts{'-intag'}) {
+		return "$chr";
+	} else {
+		return "<span class=\"cntrl\">$chr</span>";
+	}
 }
 
 # Alternatively use unicode control pictures codepoints,
@@ -866,7 +871,7 @@ sub chop_and_escape_str {
 	if ($chopped eq $str) {
 		return esc_html($chopped);
 	} else {
-		return qq{<span title="} . esc_html($str) . qq{">} .
+		return qq{<span title="} . esc_html($str, -intag=>1) . qq{">} .
 			esc_html($chopped) . qq{</span>};
 	}
 }

-- 
1.5.2.4

Jakub Narebski· Feb 17, 2008, 17:48 UTC · re: Robert Schiele · lore

[PATCH] gitweb: Add new option -nohtml to quot_xxx subroutines

Add support for new option -nohtml to quot_cec and quot_upr subroutines, to have output not wrapped in HTML tags. This makes those subroutines suitable to quoting attributes values, and for plain text output quoting. Currently this API is not used yet.

While at it fix whitespace, and use ';' as delimiter, not separator.

The option to not wrap quot_cec output in HTML tag were proposed
originally in patch:
  "Don't open a XML tag while another one is already open"
  Message-ID: <20080216191628.GK30676@schiele.dyndns.org>
by Robert Schiele.  Originally the parameter was named '-notag', was
also supportted by esc_html (but not esc_path) which passed it down to
quot_cec.  Mentioned patch was meant to fix the bug Martin Koegler
reported in his mail
  "Invalid html output repo.or.cz (alt-git.git)"
  Message-ID: <20080216130037.GA14571@auto.tuwien.ac.at>
which was fixed in different way (do not use esc_html to escape and
quote HTML attributes).

Signed-off-by: Robert Schiele <rschiele@gmail.com>
Signed-off-by: Jakub Narebski <jnareb@gmail.com>
---

 gitweb/gitweb.perl |   37 ++++++++++++++++++++++++-------------
 1 files changed, 24 insertions(+), 13 deletions(-)

Show changes to gitweb/gitweb.perl +24 −13

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index acf155c..b598366 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -753,29 +753,40 @@ sub esc_path {
 # Make control characters "printable", using character escape codes (CEC)
 sub quot_cec {
 	my $cntrl = shift;
+	my %opts = @_;
 	my %es = ( # character escape codes, aka escape sequences
-		   "\t" => '\t',   # tab            (HT)
-		   "\n" => '\n',   # line feed      (LF)
-		   "\r" => '\r',   # carrige return (CR)
-		   "\f" => '\f',   # form feed      (FF)
-		   "\b" => '\b',   # backspace      (BS)
-		   "\a" => '\a',   # alarm (bell)   (BEL)
-		   "\e" => '\e',   # escape         (ESC)
-		   "\013" => '\v', # vertical tab   (VT)
-		   "\000" => '\0', # nul character  (NUL)
-		   );
+		"\t" => '\t',   # tab            (HT)
+		"\n" => '\n',   # line feed      (LF)
+		"\r" => '\r',   # carrige return (CR)
+		"\f" => '\f',   # form feed      (FF)
+		"\b" => '\b',   # backspace      (BS)
+		"\a" => '\a',   # alarm (bell)   (BEL)
+		"\e" => '\e',   # escape         (ESC)
+		"\013" => '\v', # vertical tab   (VT)
+		"\000" => '\0', # nul character  (NUL)
+	);
 	my $chr = ( (exists $es{$cntrl})
 		    ? $es{$cntrl}
 		    : sprintf('\%03o', ord($cntrl)) );
-	return "<span class=\"cntrl\">$chr</span>";
+	if ($opts{-nohtml}) {
+		return $chr;
+	} else {
+		return "<span class=\"cntrl\">$chr</span>";
+	}
 }
 
 # Alternatively use unicode control pictures codepoints,
 # Unicode "printable representation" (PR)
 sub quot_upr {
 	my $cntrl = shift;
+	my %opts = @_;
+
 	my $chr = sprintf('&#%04d;', 0x2400+ord($cntrl));
-	return "<span class=\"cntrl\">$chr</span>";
+	if ($opts{-nohtml}) {
+		return $chr;
+	} else {
+		return "<span class=\"cntrl\">$chr</span>";
+	}
 }
 
 # git may return quoted and escaped filenames
@@ -800,7 +811,7 @@ sub unquote {
 			return chr(oct($seq));
 		} elsif (exists $es{$seq}) {
 			# C escape sequence, aka character escape code
-			return $es{$seq}
+			return $es{$seq};
 		}
 		# quoted ordinary character
 		return $seq;

patchDon't open a XML tag while another one is already open