[PATCH] gitweb: Escape attribute in chop_and_escape_str()

Jürgen Kreileder· Nov 28, 2011, 23:27 UTC · lore

Fixes the title attribute in <span title="JÃ¼rgen Kreileder">Jürgen Kreileder</span> for example because to_utf8() is called implicitly now.

(Not sure why the attribute is there at all in the example. From my point of view nothing got chopped.)

Signed-off-by: Juergen Kreileder <jk@blackdown.de>
---
 gitweb/gitweb.perl |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Show changes to gitweb/gitweb.perl +1 −1

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 4f0c3bd..fd76407 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -1699,7 +1699,7 @@ sub chop_and_escape_str {
 		return esc_html($chopped);
 	} else {
 		$str =~ s/[[:cntrl:]]/?/g;
-		return $cgi->span({-title=>$str}, esc_html($chopped));
+		return $cgi->span({-title => esc_attr($str)}, esc_html($chopped));
 	}
 }

-- 
1.7.5.4

Jakub Narebski· Nov 29, 2011, 19:33 UTC · re: Jürgen Kreileder · lore

Re: [PATCH] gitweb: Escape attribute in chop_and_escape_str()

Jürgen Kreileder <jk@blackdown.de> writes:

Show 5 quoted lines

> Fixes the title attribute in <span title="JÃ¼rgen Kreileder">Jürgen
> Kreileder</span> for example because to_utf8() is called implicitly now.
> 
> (Not sure why the attribute is there at all in the example. From my
> point of view nothing got chopped.)

Hmmm... this should not happen because of

	my $chopped = chop_str(@_);
	if ($chopped eq $str) {
		return esc_html($chopped);
	} else 
 
Perhaps it is a matter of doing to_utf8() on $str prior to comparison?

Show 19 quoted lines

> Signed-off-by: Juergen Kreileder <jk@blackdown.de>
> ---
>  gitweb/gitweb.perl |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
> index 4f0c3bd..fd76407 100755
> --- a/gitweb/gitweb.perl
> +++ b/gitweb/gitweb.perl
> @@ -1699,7 +1699,7 @@ sub chop_and_escape_str {
>  		return esc_html($chopped);
>  	} else {
>  		$str =~ s/[[:cntrl:]]/?/g;
> -		return $cgi->span({-title=>$str}, esc_html($chopped));
> +		return $cgi->span({-title => esc_attr($str)}, esc_html($chopped));
>  	}
>  }
> 
> --

esc_attr() is a wrong solution here, because $cgi->span(...) should properly escape attributes. You should simply use to_utf8() or sanitize().

Well, uless we simply do

  $str = to_utf8($str);

earlier.

-- 
Jakub Narębski

patchgitweb: Escape attribute in chop_and_escape_str()