# [PATCH] gitweb: Escape attribute in chop_and_escape_str()

2 messages from 2011-11-28 to 2011-11-29. Participants: Jürgen Kreileder, Jakub Narebski.
Thread: https://gitlist.dev/t/29039

## Jürgen Kreileder, 2011-11-28 23:27

Subject: [PATCH] gitweb: Escape attribute in chop_and_escape_str()
Message-ID: <CAKD0UuyOMRFHE6DvuDj0ancfwFfg8ADKab6emv99+FN5RfZ=mQ@mail.gmail.com>
URL: https://gitlist.dev/e/CAKD0UuyOMRFHE6DvuDj0ancfwFfg8ADKab6emv99%2BFN5RfZ%3DmQ%40mail.gmail.com

```
Fixes the title attribute in <span title="Jürgen Kreileder">Jürgen
Kreileder</span>
for example because to_utf8() is called implicitly now.

(Not sure why the attribute is there at all in the example. From my
point of view
nothing got chopped.)

Signed-off-by: Juergen Kreileder <jk@blackdown.de>
---
 gitweb/gitweb.perl |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 4f0c3bd..fd76407 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -1699,7 +1699,7 @@ sub chop_and_escape_str {
 		return esc_html($chopped);
 	} else {
 		$str =~ s/[[:cntrl:]]/?/g;
-		return $cgi->span({-title=>$str}, esc_html($chopped));
+		return $cgi->span({-title => esc_attr($str)}, esc_html($chopped));
 	}
 }

-- 
1.7.5.4

```

## Jakub Narebski, 2011-11-29 19:33

Subject: Re: [PATCH] gitweb: Escape attribute in chop_and_escape_str()
Message-ID: <m3liqylo5u.fsf@localhost.localdomain>
URL: https://gitlist.dev/e/m3liqylo5u.fsf%40localhost.localdomain
In-Reply-To: <CAKD0UuyOMRFHE6DvuDj0ancfwFfg8ADKab6emv99+FN5RfZ=mQ@mail.gmail.com>

```
Jürgen Kreileder <jk@blackdown.de> writes:

> Fixes the title attribute in <span title="Jürgen Kreileder">Jürgen
> Kreileder</span> for example because to_utf8() is called implicitly now.
> 
> (Not sure why the attribute is there at all in the example. From my
> point of view nothing got chopped.)

Hmmm... this should not happen because of

	my $chopped = chop_str(@_);
	if ($chopped eq $str) {
		return esc_html($chopped);
	} else 
 
Perhaps it is a matter of doing to_utf8() on $str prior to comparison?

> Signed-off-by: Juergen Kreileder <jk@blackdown.de>
> ---
>  gitweb/gitweb.perl |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
> index 4f0c3bd..fd76407 100755
> --- a/gitweb/gitweb.perl
> +++ b/gitweb/gitweb.perl
> @@ -1699,7 +1699,7 @@ sub chop_and_escape_str {
>  		return esc_html($chopped);
>  	} else {
>  		$str =~ s/[[:cntrl:]]/?/g;
> -		return $cgi->span({-title=>$str}, esc_html($chopped));
> +		return $cgi->span({-title => esc_attr($str)}, esc_html($chopped));
>  	}
>  }
> 
> -- 

esc_attr() is a wrong solution here, because $cgi->span(...) should
properly escape attributes.  You should simply use to_utf8() or
sanitize().

Well, uless we simply do

  $str = to_utf8($str);

earlier.

-- 
Jakub Narębski

```