* [PATCH] gitweb: escape link body in format_ref_marker
@ 2016-07-29 14:49 Andreas Brauchli
2016-07-30 17:46 ` Jakub Narębski
0 siblings, 1 reply; 4+ messages in thread
From: Andreas Brauchli @ 2016-07-29 14:49 UTC (permalink / raw)
To: git
Fix a case where an html link can be generated from unescaped input
resulting in invalid strict xhtml or potentially injected code.
An overview of a repo with a tag "1.0.0&0.0.1" would previously result
in an unescaped amperstand in the link body.
Signed-off-by: Andreas Brauchli <a.brauchli@elementarea.net>
---
gitweb/gitweb.perl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 2fddf75..33d701d 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -2090,7 +2090,7 @@ sub format_ref_marker {
-href => href(
action=>$dest_action,
hash=>$dest
- )}, $name);
+ )}, esc_html($name));
$markers .= " <span
class=\"".esc_attr($class)."\" title=\"".esc_attr($ref)."\">" .
$link . "</span>";
--
2.7.4
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] gitweb: escape link body in format_ref_marker
2016-07-29 14:49 [PATCH] gitweb: escape link body in format_ref_marker Andreas Brauchli
@ 2016-07-30 17:46 ` Jakub Narębski
2016-08-01 19:54 ` Junio C Hamano
0 siblings, 1 reply; 4+ messages in thread
From: Jakub Narębski @ 2016-07-30 17:46 UTC (permalink / raw)
To: Andreas Brauchli, git
W dniu 29.07.2016 o 16:49, Andreas Brauchli pisze:
> Fix a case where an html link can be generated from unescaped input
> resulting in invalid strict xhtml or potentially injected code.
>
> An overview of a repo with a tag "1.0.0&0.0.1" would previously result
> in an unescaped amperstand in the link body.
s/amperstand/ampersand/
^---------------- [ spurious 't' ]
Unescaped ampersand would cause trouble if gitweb output is in XHTML
mode, as some web browsers are strict about validating XML, and do not
display anything (note: this detail is unnecessary in the commit
message).
I guess that "1.0.0&0.0.1" tags are something encountered in real
repositories, while "1<b>2" would be just something evil...
>
> Signed-off-by: Andreas Brauchli <a.brauchli@elementarea.net>
Good catch!
Acked-by: Jakub Narębski <jnareb@gmail.com>
> ---
> gitweb/gitweb.perl | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
> index 2fddf75..33d701d 100755
> --- a/gitweb/gitweb.perl
> +++ b/gitweb/gitweb.perl
> @@ -2090,7 +2090,7 @@ sub format_ref_marker {
> -href => href(
> action=>$dest_action,
> hash=>$dest
> - )}, $name);
> + )}, esc_html($name));
>
> $markers .= " <span
> class=\"".esc_attr($class)."\" title=\"".esc_attr($ref)."\">" .
> $link . "</span>";
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] gitweb: escape link body in format_ref_marker
2016-07-30 17:46 ` Jakub Narębski
@ 2016-08-01 19:54 ` Junio C Hamano
2016-08-02 10:25 ` Andreas Brauchli
0 siblings, 1 reply; 4+ messages in thread
From: Junio C Hamano @ 2016-08-01 19:54 UTC (permalink / raw)
To: Jakub Narębski; +Cc: Andreas Brauchli, git
Jakub Narębski <jnareb@gmail.com> writes:
> Good catch!
>
> Acked-by: Jakub Narębski <jnareb@gmail.com>
Sigh; the contents may be good but the patch is unusable as-is
because of heavy whitespace damage.
I'll fix it up. Thanks, both.
>> ---
>> gitweb/gitweb.perl | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
>> index 2fddf75..33d701d 100755
>> --- a/gitweb/gitweb.perl
>> +++ b/gitweb/gitweb.perl
>> @@ -2090,7 +2090,7 @@ sub format_ref_marker {
>> -href => href(
>> action=>$dest_action,
>> hash=>$dest
>> - )}, $name);
>> + )}, esc_html($name));
>>
>> $markers .= " <span
>> class=\"".esc_attr($class)."\" title=\"".esc_attr($ref)."\">" .
>> $link . "</span>";
>>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] gitweb: escape link body in format_ref_marker
2016-08-01 19:54 ` Junio C Hamano
@ 2016-08-02 10:25 ` Andreas Brauchli
0 siblings, 0 replies; 4+ messages in thread
From: Andreas Brauchli @ 2016-08-02 10:25 UTC (permalink / raw)
To: Junio C Hamano; +Cc: Jakub Narębski, git
On Mon, Aug 1, 2016 at 9:54 PM, Junio C Hamano <gitster@pobox.com> wrote:
> Jakub Narębski <jnareb@gmail.com> writes:
>
>> Good catch!
>>
>> Acked-by: Jakub Narębski <jnareb@gmail.com>
>
> Sigh; the contents may be good but the patch is unusable as-is
> because of heavy whitespace damage.
>
> I'll fix it up. Thanks, both.
My apologies for that, it seems that gmail doesn't do tabs.
I resubmitted the PR as #283 on GitHub along with Jakub's Ack and
fixed the typo he pointed out in the commit message
https://github.com/git/git/pull/283
Kind regards
andreas
>
>>> ---
>>> gitweb/gitweb.perl | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
>>> index 2fddf75..33d701d 100755
>>> --- a/gitweb/gitweb.perl
>>> +++ b/gitweb/gitweb.perl
>>> @@ -2090,7 +2090,7 @@ sub format_ref_marker {
>>> -href => href(
>>> action=>$dest_action,
>>> hash=>$dest
>>> - )}, $name);
>>> + )}, esc_html($name));
>>>
>>> $markers .= " <span
>>> class=\"".esc_attr($class)."\" title=\"".esc_attr($ref)."\">" .
>>> $link . "</span>";
>>>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-08-02 10:25 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-07-29 14:49 [PATCH] gitweb: escape link body in format_ref_marker Andreas Brauchli
2016-07-30 17:46 ` Jakub Narębski
2016-08-01 19:54 ` Junio C Hamano
2016-08-02 10:25 ` Andreas Brauchli
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).