From: Junio C Hamano <redacted>
Date: Wed, 8 Nov 2006 23:11:10 +0000 (-0800)
Subject: gitweb: protect blob and diff output lines from controls.
X-Git-Url: https://git.ladys.computer/Gitweb/commitdiff_plain/7afd0ba68b061bc2e22d9f2c34052b652a8c5c5746e9e0b5a9c0e2b7b7a790ed

gitweb: protect blob and diff output lines from controls.

This revealed that the output from blame and tag was not chomped
properly and was relying on HTML output not noticing that extra
whitespace that resulted from the newline, which was also fixed.

Signed-off-by: Junio C Hamano <redacted>
---

diff --git a/gitweb.perl b/gitweb.perl
index 4a8bea0..ab5fefa 100755
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -577,11 +577,10 @@ sub esc_html ($;%) {
 
 	$str = to_utf8($str);
 	$str = escapeHTML($str);
-	$str =~ s/\014/^L/g; # escape FORM FEED (FF) character (e.g. in COPYING file)
-	$str =~ s/\033/^[/g; # "escape" ESCAPE (\e) character (e.g. commit 20a3847d8a5032ce41f90dcc68abfb36e6fee9b1)
 	if ($opts{'-nbsp'}) {
 		$str =~ s/ /&nbsp;/g;
 	}
+	$str =~ s|([[:cntrl:]])|(($1 ne "\t") ? quot_cec($1) : $1)|eg;
 	return $str;
 }
 
@@ -1880,17 +1879,17 @@ sub git_print_page_path {
 			$fullname .= ($fullname ? '/' : '') . $dir;
 			print $cgi->a({-href => href(action=>"tree", file_name=>$fullname,
 			                             hash_base=>$hb),
-			              -title => $fullname}, esc_path($dir));
+			              -title => esc_html($fullname)}, esc_path($dir));
 			print " / ";
 		}
 		if (defined $type && $type eq 'blob') {
 			print $cgi->a({-href => href(action=>"blob_plain", file_name=>$file_name,
 			                             hash_base=>$hb),
-			              -title => $name}, esc_path($basename));
+			              -title => esc_html($name)}, esc_path($basename));
 		} elsif (defined $type && $type eq 'tree') {
 			print $cgi->a({-href => href(action=>"tree", file_name=>$file_name,
 			                             hash_base=>$hb),
-			              -title => $name}, esc_path($basename));
+			              -title => esc_html($name)}, esc_path($basename));
 			print " / ";
 		} else {
 			print esc_path($basename);
@@ -2852,6 +2851,7 @@ sub git_tag {
 	print "<div class=\"page_body\">";
 	my $comment = $tag{'comment'};
 	foreach my $line (@$comment) {
+		chomp($line);
 		print esc_html($line) . "<br/>\n";
 	}
 	print "</div>\n";
@@ -2921,6 +2921,7 @@ HTML
 			}
 		}
 		my $data = $_;
+		chomp($data);
 		my $rev = substr($full_rev, 0, 8);
 		my $author = $meta->{'author'};
 		my %date = parse_date($meta->{'author-time'},