gitweb: Protect escaping functions against calling on undef

This is a bit of future-proofing esc_html and friends: when called with undefined value they would now would return undef... which would probably mean that error would still occur, but closer to the source of problem. This means that we can safely use esc_html(shift) || "Internal Server Error" in die_error() instead of esc_html(shift || "Internal Server Error") Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jakub Narebski committed Feb 7, 2010 at 21:52 UTC 1df48766137f2040e2e992d7d278d5aca26406cf

1 file changed +8 -1

gitweb/gitweb.perl

+8 -1

@@ -1143,6 +1143,7 @@ sub validate_refname {

1143 # in utf-8 thanks to "binmode STDOUT, ':utf8'" at beginning

1144 sub to_utf8 {

1145 my $str = shift;

1146 + return undef unless defined $str;

1147 if (utf8::valid($str)) {

1148 utf8::decode($str);

1149 return $str;

@@ -1155,6 +1156,7 @@ sub to_utf8 {

1156 # correct, but quoted slashes look too horrible in bookmarks

1157 sub esc_param {

1158 my $str = shift;

1159 + return undef unless defined $str;

1160 $str =~ s/([^A-Za-z0-9\-_.~()\/:@ ]+)/CGI::escape($1)/eg;

1161 $str =~ s/ /\+/g;

1162 return $str;

@@ -1163,6 +1165,7 @@ sub esc_param {

1165 # quote unsafe chars in whole URL, so some charactrs cannot be quoted

1166 sub esc_url {

1167 my $str = shift;

1168 + return undef unless defined $str;

1169 $str =~ s/([^A-Za-z0-9\-_.~();\/;?:@&=])/sprintf("%%%02X", ord($1))/eg;

1170 $str =~ s/\+/%2B/g;

1171 $str =~ s/ /\+/g;

@@ -1174,6 +1177,8 @@ sub esc_html {

1177 my $str = shift;

1178 my %opts = @_;

1179

1180 + return undef unless defined $str;

1181 +

1182 $str = to_utf8($str);

1183 $str = $cgi->escapeHTML($str);

1184 if ($opts{'-nbsp'}) {

@@ -1188,6 +1193,8 @@ sub esc_path {

1193 my $str = shift;

1194 my %opts = @_;

1195

1196 + return undef unless defined $str;

1197 +

1198 $str = to_utf8($str);

1199 $str = $cgi->escapeHTML($str);

1200 if ($opts{'-nbsp'}) {

@@ -3387,7 +3394,7 @@ sub git_footer_html {

3394 # or down for maintenance). Generally, this is a temporary state.

3395 sub die_error {

3396 my $status = shift || 500;

3390 - my $error = esc_html(shift || "Internal Server Error");

3397 + my $error = esc_html(shift) || "Internal Server Error";

3398 my $extra = shift;

3399

3400 my %http_responses = (