"Nested quantifiers" error in gitweb with "++" in the filename

"Nested quantifiers" error in gitweb with "++" in the filename

[Jehan Bing]

Hi,

I'm getting an error when trying to look at a blob when the filename has 
"++" in it:

http://.../blob/13ec1624fefc23d20d0407aac3337b35844a2ceb:/foo-++.txt

And I get the following error page:
	gitprojects /


	500 - Internal Server Error
	Nested quantifiers in regex; marked by <-- HERE in 
m//test.git/blob/13ec1624fefc23d20d0407aac3337b35844a2ceb:/foo-++ <-- 
HERE .txt$/ at (eval 10) line 7.
	OPML TXT


The Apache log show the same thing:
  gitweb.cgi: Nested quantifiers in regex; marked by <-- HERE in 
m//test.git/blob/13ec1624fefc23d20d0407aac3337b35844a2ceb:/foo-++ <-- 
HERE .txt$/ at (eval 10) line 7.


It works fine if the filename has a single '+' sign (tried "foo-+.txt").
There is a same error when browsing a tree and clicking a directory with 
the "++"

We notice the error when looking at the Qt source code. They have a 
bunch of "*g++*" files and directories.

We use git-1.7.6 but updating to gitweb.cgi from 1.7.8.1 didn't fix it.


Regards,
	Jehan

Re: "Nested quantifiers" error in gitweb with "++" in the filename

[demerphq]

On 22 December 2011 21:37, Jehan Bing <jehan@orb.com> wrote:
> Hi,
>
> I'm getting an error when trying to look at a blob when the filename has
> "++" in it:
>
> http://.../blob/13ec1624fefc23d20d0407aac3337b35844a2ceb:/foo-++.txt

This error comes because the filename is being used a pattern without
being protected by a quotemeta.

Interestingly, a later version of perl would not have this problem as
++ is a legal quantifier as of 5.10, nevertheless it probably wouldnt
do what you expected.

yves
-- 
perl -Mre=debug -e "/just|another|perl|hacker/"

Re: "Nested quantifiers" error in gitweb with "++" in the filename

[Jehan Bing]

On 2011-12-23 08:02, demerphq wrote:
> On 22 December 2011 21:37, Jehan Bing<jehan@orb.com>  wrote:
>> Hi,
>>
>> I'm getting an error when trying to look at a blob when the filename has
>> "++" in it:
>>
>> http://.../blob/13ec1624fefc23d20d0407aac3337b35844a2ceb:/foo-++.txt
>
> This error comes because the filename is being used a pattern without
> being protected by a quotemeta.
>
> Interestingly, a later version of perl would not have this problem as
> ++ is a legal quantifier as of 5.10, nevertheless it probably wouldnt
> do what you expected.
>

Interestingly, a later version of perl would not have this problem as, 
after investigating the problem further, it's actually a bug in CGI.pm 
which has since been fixed ;)

My distribution comes with an old version of CGI.pm (3.15 from perl 
5.8.8). After updating to the latest, the problem went away.