gitweb: escape URLs generated by href()

[Gitweb] / gitweb.perl

diff --git a/gitweb.perl b/gitweb.perl
index 87c8dc000518f3bccda21db160d175e305014f1da82383fe2930e2be3a5042c4..d1264baed2992ddb9319d6069c55a45b208de60c92a8643ae919a529cb7af668 100755 (executable)
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -4049,7 +4049,7 @@ sub print_feed_meta {
 
                        $href_params{'extra_options'} = undef;
                        $href_params{'action'} = $type;
 
                        $href_params{'extra_options'} = undef;
                        $href_params{'action'} = $type;

-                       $link_attr{'-href'} = href(%href_params);
+                       $link_attr{'-href'} = esc_attr(href(%href_params));

                        print "<link ".
                              "rel=\"$link_attr{'-rel'}\" ".
                              "title=\"$link_attr{'-title'}\" ".
                        print "<link ".
                              "rel=\"$link_attr{'-rel'}\" ".
                              "title=\"$link_attr{'-title'}\" ".


@@ -4058,7 +4058,7 @@ sub print_feed_meta {
                              "/>\n";
 
                        $href_params{'extra_options'} = '--no-merges';
                              "/>\n";
 
                        $href_params{'extra_options'} = '--no-merges';

-                       $link_attr{'-href'} = href(%href_params);
+                       $link_attr{'-href'} = esc_attr(href(%href_params));

                        $link_attr{'-title'} .= ' (no merges)';
                        print "<link ".
                              "rel=\"$link_attr{'-rel'}\" ".
                        $link_attr{'-title'} .= ' (no merges)';
                        print "<link ".
                              "rel=\"$link_attr{'-rel'}\" ".


@@ -4071,10 +4071,12 @@ sub print_feed_meta {
        } else {
                printf('<link rel="alternate" title="%s projects list" '.
                       'href="%s" type="text/plain; charset=utf-8" />'."\n",
        } else {
                printf('<link rel="alternate" title="%s projects list" '.
                       'href="%s" type="text/plain; charset=utf-8" />'."\n",

-                      esc_attr($site_name), href(project=>undef, action=>"project_index"));
+                      esc_attr($site_name),
+                      esc_attr(href(project=>undef, action=>"project_index")));

                printf('<link rel="alternate" title="%s projects feeds" '.
                       'href="%s" type="text/x-opml" />'."\n",
                printf('<link rel="alternate" title="%s projects feeds" '.
                       'href="%s" type="text/x-opml" />'."\n",

-                      esc_attr($site_name), href(project=>undef, action=>"opml"));
+                      esc_attr($site_name),
+                      esc_attr(href(project=>undef, action=>"opml")));

        }
 }
 
        }
 }
 


@@ -4288,8 +4290,8 @@ sub git_footer_html {
        if (defined $action &&
            $action eq 'blame_incremental') {
                print qq!<script type="text/javascript">\n!.
        if (defined $action &&
            $action eq 'blame_incremental') {
                print qq!<script type="text/javascript">\n!.

-                     qq!startBlame("!. href(action=>"blame_data", -replay=>1) .qq!",\n!.
-                     qq!           "!. href() .qq!");\n!.
+                     qq!startBlame("!. esc_attr(href(action=>"blame_data", -replay=>1)) .qq!",\n!.
+                     qq!           "!. esc_attr(href()) .qq!");\n!.

                      qq!</script>\n!;
        } else {
                my ($jstimezone, $tz_cookie, $datetime_class) =
                      qq!</script>\n!;
        } else {
                my ($jstimezone, $tz_cookie, $datetime_class) =


@@ -7156,8 +7158,8 @@ sub git_blob {
                        print qq! alt="!.esc_attr($file_name).qq!" title="!.esc_attr($file_name).qq!"!;
                }
                print qq! src="! .
                        print qq! alt="!.esc_attr($file_name).qq!" title="!.esc_attr($file_name).qq!"!;
                }
                print qq! src="! .

-                     href(action=>"blob_plain", hash=>$hash,
-                          hash_base=>$hash_base, file_name=>$file_name) .
+                     esc_attr(href(action=>"blob_plain", hash=>$hash,
+                          hash_base=>$hash_base, file_name=>$file_name)) .

                      qq!" />\n!;
        } else {
                my $nr;
                      qq!" />\n!;
        } else {
                my $nr;


@@ -8240,6 +8242,7 @@ sub git_feed {
        } else {
                $alt_url = href(-full=>1, action=>"summary");
        }
        } else {
                $alt_url = href(-full=>1, action=>"summary");
        }

+       $alt_url = esc_attr($alt_url);

        print qq!<?xml version="1.0" encoding="utf-8"?>\n!;
        if ($format eq 'rss') {
                print <<XML;
        print qq!<?xml version="1.0" encoding="utf-8"?>\n!;
        if ($format eq 'rss') {
                print <<XML;


@@ -8277,7 +8280,7 @@ XML
                      $alt_url . '" />' . "\n" .
                      '<link rel="self" type="' . $content_type . '" href="' .
                      $cgi->self_url() . '" />' . "\n" .
                      $alt_url . '" />' . "\n" .
                      '<link rel="self" type="' . $content_type . '" href="' .
                      $cgi->self_url() . '" />' . "\n" .

-                     "<id>" . href(-full=>1) . "</id>\n" .
+                     "<id>" . esc_url(href(-full=>1)) . "</id>\n" .

                      # use project owner for feed author
                      "<author><name>$owner</name></author>\n";
                if (defined $favicon) {
                      # use project owner for feed author
                      "<author><name>$owner</name></author>\n";
                if (defined $favicon) {


@@ -8323,7 +8326,7 @@ XML
                              "<author>" . esc_html($co{'author'}) . "</author>\n" .
                              "<pubDate>$cd{'rfc2822'}</pubDate>\n" .
                              "<guid isPermaLink=\"true\">$co_url</guid>\n" .
                              "<author>" . esc_html($co{'author'}) . "</author>\n" .
                              "<pubDate>$cd{'rfc2822'}</pubDate>\n" .
                              "<guid isPermaLink=\"true\">$co_url</guid>\n" .

-                             "<link>$co_url</link>\n" .
+                             "<link>" . esc_html($co_url) . "</link>\n" .

                              "<description>" . esc_html($co{'title'}) . "</description>\n" .
                              "<content:encoded>" .
                              "<![CDATA[\n";
                              "<description>" . esc_html($co{'title'}) . "</description>\n" .
                              "<content:encoded>" .
                              "<![CDATA[\n";


@@ -8345,8 +8348,8 @@ XML
                        }
                        print "</contributor>\n" .
                              "<published>$cd{'iso-8601'}</published>\n" .
                        }
                        print "</contributor>\n" .
                              "<published>$cd{'iso-8601'}</published>\n" .

-                             "<link rel=\"alternate\" type=\"text/html\" href=\"$co_url\" />\n" .
-                             "<id>$co_url</id>\n" .
+                             "<link rel=\"alternate\" type=\"text/html\" href=\"" . esc_attr($co_url) . "\" />\n" .
+                             "<id>" . esc_html($co_url) . "</id>\n" .

                              "<content type=\"xhtml\" xml:base=\"" . esc_url($my_url) . "\">\n" .
                              "<div xmlns=\"http://www.w3.org/1999/xhtml\">\n";
                }
                              "<content type=\"xhtml\" xml:base=\"" . esc_url($my_url) . "\">\n" .
                              "<div xmlns=\"http://www.w3.org/1999/xhtml\">\n";
                }


@@ -8453,8 +8456,8 @@ XML
                }
 
                my $path = esc_html(chop_str($proj{'path'}, 25, 5));
                }
 
                my $path = esc_html(chop_str($proj{'path'}, 25, 5));

-               my $rss  = href('project' => $proj{'path'}, 'action' => 'rss', -full => 1);
-               my $html = href('project' => $proj{'path'}, 'action' => 'summary', -full => 1);
+               my $rss  = esc_attr(href('project' => $proj{'path'}, 'action' => 'rss', -full => 1));
+               my $html = esc_attr(href('project' => $proj{'path'}, 'action' => 'summary', -full => 1));

                print "<outline type=\"rss\" text=\"$path\" title=\"$path\" xmlUrl=\"$rss\" htmlUrl=\"$html\"/>\n";
        }
        print <<XML;
                print "<outline type=\"rss\" text=\"$path\" title=\"$path\" xmlUrl=\"$rss\" htmlUrl=\"$html\"/>\n";
        }
        print <<XML;