stagit

commit

028c7526bac907c91ef8afc6c3ae0f6d424bd229

parent

bb1d06eb204b1d1135fcddccd14f6306abcd7f72

Author

Hiltjo Posthuma <hiltjo@codemadness.org>

Date

2019-03-16 12:07

escape HTML in paths

- escape paths in diff line.
- escape path in anchor href attribute in files.html

Diffstat

1 files changed, 12 insertions, 4 deletions

diff --git a/stagit.c b/stagit.c

@@ -532,9 +532,15 @@ printshowfile(FILE *fp, struct commitinfo *ci)
  532   532 	for (i = 0; i < ci->ndeltas; i++) {
  533   533 		patch = ci->deltas[i]->patch;
  534   534 		delta = git_patch_get_delta(patch);
  535    -1 		fprintf(fp, "<b>diff --git a/<a id=\"h%zu\" href=\"%sfile/%s.html\">%s</a> b/<a href=\"%sfile/%s.html\">%s</a></b>\n",
  536    -1 			i, relpath, delta->old_file.path, delta->old_file.path,
  537    -1 			relpath, delta->new_file.path, delta->new_file.path);
   -1   535 		fprintf(fp, "<b>diff --git a/<a id=\"h%zu\" href=\"%sfile/", i, relpath);
   -1   536 		xmlencode(fp, delta->old_file.path, strlen(delta->old_file.path));
   -1   537 		fputs(".html\">", fp);
   -1   538 		xmlencode(fp, delta->old_file.path, strlen(delta->old_file.path));
   -1   539 		fprintf(fp, "</a> b/<a href=\"%sfile/", relpath);
   -1   540 		xmlencode(fp, delta->new_file.path, strlen(delta->new_file.path));
   -1   541 		fprintf(fp, ".html\">");
   -1   542 		xmlencode(fp, delta->new_file.path, strlen(delta->new_file.path));
   -1   543 		fprintf(fp, "</a></b>\n");
  538   544 
  539   545 		/* check binary data */
  540   546 		if (delta->flags & GIT_DIFF_FLAG_BINARY) {
@@ -881,7 +887,9 @@ writefilestree(FILE *fp, git_tree *tree, const char *path)
  881   887 
  882   888 			fputs("<tr><td>", fp);
  883   889 			fputs(filemode(git_tree_entry_filemode(entry)), fp);
  884    -1 			fprintf(fp, "</td><td><a href=\"%s%s\">", relpath, filepath);
   -1   890 			fprintf(fp, "</td><td><a href=\"%s", relpath);
   -1   891 			xmlencode(fp, filepath, strlen(filepath));
   -1   892 			fputs("\">", fp);
  885   893 			xmlencode(fp, entrypath, strlen(entrypath));
  886   894 			fputs("</a></td><td class=\"num\" align=\"right\">", fp);
  887   895 			if (lc > 0)