gitweb: escape tag comments

[Gitweb] / gitweb.cgi

diff --git a/gitweb.cgi b/gitweb.cgi
index c5b62091a6f4193442d9643e9fa7cdda88bb39e230a212462b9349832ee760ad..90fff76de8c4fe3cd8ce2ea31c75e38553d22d5fcf358076d4a8a08e569fcc9d 100755 (executable)
--- a/gitweb.cgi
+++ b/gitweb.cgi
@@ -1138,7 +1138,7 @@ sub git_summary {
                                      "</td>\n" .
                                      "<td>";
                                if (defined($comment)) {
-                                     print $cgi->a({-class => "list", -href => "$my_uri?" . esc_param("p=$project;a=tag;h=$tag{'id'}")}, $comment);
+                                     print $cgi->a({-class => "list", -href => "$my_uri?" . esc_param("p=$project;a=tag;h=$tag{'id'}")}, esc_html($comment));
                                }
                                print "</td>\n" .
                                      "<td class=\"link\">";
@@ -1199,6 +1199,20 @@ sub git_summary {
        git_footer_html();
 }
 
+sub git_print_page_path {
+       my $name = shift;
+       my $type = shift;
+
+       if (!defined $name) {
+               print "<div class=\"page_path\"><b>/</b></div>\n";
+       } elsif ($type =~ "blob") {
+               print "<div class=\"page_path\"><b>" .
+                       $cgi->a({-href => "$my_uri?" . esc_param("p=$project;a=blob_plain;f=$file_name")}, esc_html($name)) . "</b><br/></div>\n";
+       } else {
+               print "<div class=\"page_path\"><b>" . esc_html($name) . "</b><br/></div>\n";
+       }
+}
+
 sub git_tag {
        my $head = git_read_head($project);
        git_header_html();
@@ -1238,15 +1252,6 @@ sub git_tag {
        git_footer_html();
 }
 
-sub git_read_blame_line {
-       my %bl;
-       $_ = shift;
-
-       ($bl{'hash'}, $bl{'lineno'}, $bl{'data'}) = /^([0-9a-fA-F]{40}).*?(\d+)\)\s{1}(\s*.*)/;
-
-       return %bl;
-}
-
 sub git_blame2 {
        my $fd;
        my $ftype;
@@ -1288,12 +1293,12 @@ sub git_blame2 {
        print "<div class=\"page_body\">\n";
        print "<table class=\"blame\">\n";
        print "<tr><th>Commit</th><th>Line</th><th>Data</th></tr>\n";
-       while (my $line = <$fd>) {
-               my %blame_line = git_read_blame_line($line);
-               my $full_rev = $blame_line{'hash'};
+       while (<$fd>) {
+               /^([0-9a-fA-F]{40}).*?(\d+)\)\s{1}(\s*.*)/;
+               my $full_rev = $1;
                my $rev = substr($full_rev, 0, 8);
-               my $lineno = $blame_line{'lineno'};
-               my $data = $blame_line{'data'};
+               my $lineno = $2;
+               my $data = $3;
 
                if (!defined $last_rev) {
                        $last_rev = $full_rev;
@@ -1342,7 +1347,7 @@ sub git_blame {
                "<div>" .
                $cgi->a({-href => "$my_uri?" . esc_param("p=$project;a=commit;h=$hash_base"), -class => "title"}, esc_html($co{'title'})) .
                "</div>\n";
-       print "<div class=\"page_path\"><b>" . esc_html($file_name) . "</b></div>\n";
+       git_print_page_path($file_name);
        print "<div class=\"page_body\">\n";
        print <<HTML;
 <table class="blame">
@@ -1680,9 +1685,7 @@ sub git_blob {
                      "<br/><br/></div>\n" .
                      "<div class=\"title\">$hash</div>\n";
        }
-       if (defined $file_name) {
-               print "<div class=\"page_path\"><b>" . esc_html($file_name) . "</b></div>\n";
-       }
+       git_print_page_path($file_name, "blob");
        print "<div class=\"page_body\">\n";
        my $nr;
        while (my $line = <$fd>) {
@@ -1747,10 +1750,8 @@ sub git_tree {
        }
        if (defined $file_name) {
                $base = esc_html("$file_name/");
-               print "<div class=\"page_path\"><b>/" . esc_html($file_name) . "</b></div>\n";
-       } else {
-               print "<div class=\"page_path\"><b>/</b></div>\n";
        }
+       git_print_page_path($file_name);
        print "<div class=\"page_body\">\n";
        print "<table cellspacing=\"0\">\n";
        my $alternate = 0;
@@ -2214,9 +2215,7 @@ sub git_blobdiff {
                      "<br/><br/></div>\n" .
                      "<div class=\"title\">$hash vs $hash_parent</div>\n";
        }
-       if (defined $file_name) {
-               print "<div class=\"page_path\"><b>/" . esc_html($file_name) . "</b></div>\n";
-       }
+       git_print_page_path($file_name, "blob");
        print "<div class=\"page_body\">\n" .
              "<div class=\"diff_info\">blob:" .
              $cgi->a({-href => "$my_uri?" . esc_param("p=$project;a=blob;h=$hash_parent;hb=$hash_base;f=$file_name")}, $hash_parent) .
@@ -2390,6 +2389,7 @@ sub git_history {
        if (!defined $hash_base) {
                $hash_base = git_read_head($project);
        }
+       my $ftype;
        my %co = git_read_commit($hash_base);
        if (!%co) {
                die_error(undef, "Unknown commit object.");
@@ -2412,17 +2412,9 @@ sub git_history {
                $hash = git_get_hash_by_path($hash_base, $file_name);
        }
        if (defined $hash) {
-               my $ftype = git_get_type($hash);
-
-               if ($ftype =~ "blob") {
-                   print "<div class=\"page_path\"><b>/" .
-                       $cgi->a({-href => "$my_uri?" . esc_param("p=$project;a=blob_plain;f=$file_name")}, esc_html($file_name)) . "</b><br/></div>\n";
-               } else {
-                   print "<div class=\"page_path\"><b>/" . esc_html($file_name) . "</b><br/></div>\n";
-               }
-       } else {
-               print "<div class=\"page_path\"><b>/" . esc_html($file_name) . "</b><br/></div>\n";
+               $ftype = git_get_type($hash);
        }
+       git_print_page_path($file_name, $ftype);
 
        open my $fd, "-|",
                "$GIT rev-list --full-history $hash_base -- \'$file_name\'";