Re: [PATCH 4/n] gitweb: Secure against commit-ish/tree-ish with the same name as path

[Jakub Narebski <jnareb@gmail.com>]

Junio C Hamano wrote:

> I'll be pushing out a "master" update
> sometime today, and do not expect to be able to get to your "n
> turned out to be ten" series, so it might be worthwhile to
> reroll the remaining bits that you still care about on top of
> what I push out tonight to make sure we are on the same page.

I'll wait a while if there are any comments (for example on formatting
used), and resend cleaned-up series.

> Preferably:
>
>  - you should avoid making a series out of more-or-less
>    unrelated things;

Well, truly unrelated were adding "--" to secure against ref with
the same name as path in the repository (but it was discovered
during testing the series) and replacing ' ' with ' ' in blob
and diff body for non-CSS aware browsers.

Better quoting and unquoting was needed for better commitdiff view.
Ah, well, perhaps it is unrelated.

Securing against filenames with LF for example has sense only if
there can be filenames with LF, and earlier gitweb unquoted it halfway
leaving '\n' instead of LF.

>  - if you are doing related things in one series, do not send
>    half-baked early parts out until you are finished and are
>    confident with it.

I've send series early to get some comments, but I see while I got
some comments on "take 1" and "take 2" on _single_ "new commitdiff"
RFC patch, I got comments only about half-baked '&iquot;' idea.
-- 
Jakub Narebski