www: more restrictive query string parsing

Only allow single-character query keys to prevent clients from
wasting memory in Perl's hash tables.  We'll also perform the
utf8::decode and tr/+/ / calls once on the whole query string at
once to reduce op calls.

This also avoids creating an empty hash in the common case
when the QUERY_STRING is empty and instead relies on
auto-vivification of Perl.

1 files changed, 1 insertions, 2 deletions

diff --git a/lib/PublicInbox/ViewVCS.pm b/lib/PublicInbox/ViewVCS.pm
index eb757089..5529ed5b 100644
--- a/lib/PublicInbox/ViewVCS.pm
+++ b/lib/PublicInbox/ViewVCS.pm
@@ -596,10 +596,9 @@ sub show_blob { # git->cat_async callback
 # GET /$INBOX/$GIT_OBJECT_ID/s/$FILENAME
 sub show ($$;$) {
         my ($ctx, $oid_b, $fn) = @_;
-        my $qp = $ctx->{qp};
         my $hints = $ctx->{hints} = {};
         while (my ($from, $to) = each %QP_MAP) {
-                defined(my $v = $qp->{$from}) or next;
+                my $v = $ctx->{qp}->{$from} // next;
                 $hints->{$to} = $v if $v ne '';
         }
         $ctx->{fn} = $fn;