gitweb: escape link body in format_ref_marker
Fix a case where an html link can be generated from unescaped input resulting in invalid strict xhtml or potentially injected code. An overview of a repo with a tag "1.0.0&0.0.1" would previously result in an unescaped ampersand in the link body. Signed-off-by: Andreas Brauchli <a.brauchli@elementarea.net> Acked-by: Jakub Narębski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Andreas Brauchli committed
Jul 29, 2016 at 16:49 UTC
77947bbe24e0306d1ce5605c962c4a25f5aca22f
1 file changed
+1
-1
gitweb/gitweb.perl
+1
-1
@@ -2090,7 +2090,7 @@ sub format_ref_marker {
2090
-href => href(
2091
action=>$dest_action,
2092
hash=>$dest
2093
- )}, $name);
2093
+ )}, esc_html($name));
2094
2095
$markers .= " <span class=\"".esc_attr($class)."\" title=\"".esc_attr($ref)."\">" .
2096
$link . "</span>";