Revision 77947bbe24e0306d1ce5605c962c4a25f5aca22f authored by Andreas Brauchli on 29 July 2016, 14:49:37 UTC, committed by Junio C Hamano on 01 August 2016, 19:55:40 UTC
Fix a case where an html link can be generated from unescaped input resulting in invalid strict xhtml or potentially injected code. An overview of a repo with a tag "1.0.0&0.0.1" would previously result in an unescaped ampersand in the link body. Signed-off-by: Andreas Brauchli <a.brauchli@elementarea.net> Acked-by: Jakub Narębski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
1 parent 0b65a8d
test-fake-ssh.c
#include "git-compat-util.h"
#include "run-command.h"
#include "strbuf.h"
int main(int argc, char **argv)
{
const char *trash_directory = getenv("TRASH_DIRECTORY");
struct strbuf buf = STRBUF_INIT;
FILE *f;
int i;
const char *child_argv[] = { NULL, NULL };
/* First, print all parameters into $TRASH_DIRECTORY/ssh-output */
if (!trash_directory)
die("Need a TRASH_DIRECTORY!");
strbuf_addf(&buf, "%s/ssh-output", trash_directory);
f = fopen(buf.buf, "w");
if (!f)
die("Could not write to %s", buf.buf);
for (i = 0; i < argc; i++)
fprintf(f, "%s%s", i > 0 ? " " : "", i > 0 ? argv[i] : "ssh:");
fprintf(f, "\n");
fclose(f);
/* Now, evaluate the *last* parameter */
if (argc < 2)
return 0;
child_argv[0] = argv[argc - 1];
return run_command_v_opt(child_argv, RUN_USING_SHELL);
}
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...