Skip to content

Commit

Permalink
gitweb: Don't escape attributes in CGI.pm HTML methods
Browse files Browse the repository at this point in the history
There is no need to escape HTML tag's attributes in CGI.pm
HTML methods (like CGI::a()), because CGI.pm does attribute
escaping automatically.

  $cgi->a({ ... -attribute => atribute_value }, tag_contents)

is translated to

  <a ... attribute="attribute_value">tag_contents</a>

The rules for escaping attribute values (which are string contents) are
different. For example you have to take care about escaping embedded '"'
and "'" characters; CGI::a() does that for us automatically.

CGI::a() does not HTML escape tag_contents; we would need to write

  <a href="URL">some <b>bold</b> text</a>

for example. So we use esc_html (or esc_path) to escape tag_contents
as needed.

Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
  • Loading branch information
Jakub Narebski authored and Junio C Hamano committed Mar 7, 2007
1 parent c390ae9 commit edc04e9
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions gitweb/gitweb.perl
Original file line number Diff line number Diff line change
Expand Up @@ -1974,17 +1974,17 @@ sub git_print_page_path {
$fullname .= ($fullname ? '/' : '') . $dir;
print $cgi->a({-href => href(action=>"tree", file_name=>$fullname,
hash_base=>$hb),
-title => esc_html($fullname)}, esc_path($dir));
-title => $fullname}, esc_path($dir));
print " / ";
}
if (defined $type && $type eq 'blob') {
print $cgi->a({-href => href(action=>"blob_plain", file_name=>$file_name,
hash_base=>$hb),
-title => esc_html($name)}, esc_path($basename));
-title => $name}, esc_path($basename));
} elsif (defined $type && $type eq 'tree') {
print $cgi->a({-href => href(action=>"tree", file_name=>$file_name,
hash_base=>$hb),
-title => esc_html($name)}, esc_path($basename));
-title => $name}, esc_path($basename));
print " / ";
} else {
print esc_path($basename);
Expand Down

0 comments on commit edc04e9

Please sign in to comment.