From 1e25ac5b8fe0ca8760b2786b20d36013a6197e02 Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Thu, 21 Jul 2011 23:04:53 +0200 Subject: Remove dead initialization in cgit_parse_commit() The value stored to "t" during its initialization gets overwritten in any case, so just leave it uninitialized. Spotted by clang-analyzer. Signed-off-by: Lukas Fleischer Signed-off-by: Lars Hjemli --- parsing.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/parsing.c b/parsing.c index 151c0fe..602e3de 100644 --- a/parsing.c +++ b/parsing.c @@ -125,7 +125,7 @@ const char *reencode(char **txt, const char *src_enc, const char *dst_enc) struct commitinfo *cgit_parse_commit(struct commit *commit) { struct commitinfo *ret; - char *p = commit->buffer, *t = commit->buffer; + char *p = commit->buffer, *t; ret = xmalloc(sizeof(*ret)); ret->commit = commit; -- cgit 1.4.1 From bebe89d7c11a92bf206bf6e528c51ffa8ecbc0d5 Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Fri, 22 Jul 2011 13:47:19 +0200 Subject: Fix potential XSS vulnerability in rename hint The file name displayed in the rename hint should be escaped to avoid XSS. Note that this vulnerability is only applicable when an attacker has gained push access to the repository. Signed-off-by: Lukas Fleischer Signed-off-by: Lars Hjemli --- ui-diff.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/ui-diff.c b/ui-diff.c index d21541b..383a534 100644 --- a/ui-diff.c +++ b/ui-diff.c @@ -97,10 +97,12 @@ static void print_fileinfo(struct fileinfo *info) htmlf("", class); cgit_diff_link(info->new_path, NULL, NULL, ctx.qry.head, ctx.qry.sha1, ctx.qry.sha2, info->new_path, 0); - if (info->status == DIFF_STATUS_COPIED || info->status == DIFF_STATUS_RENAMED) - htmlf(" (%s from %s)", - info->status == DIFF_STATUS_COPIED ? "copied" : "renamed", - info->old_path); + if (info->status == DIFF_STATUS_COPIED || info->status == DIFF_STATUS_RENAMED) { + htmlf(" (%s from ", + info->status == DIFF_STATUS_COPIED ? "copied" : "renamed"); + html_txt(info->old_path); + html(")"); + } html(""); if (info->binary) { htmlf("bin%ld -> %ld bytes", -- cgit 1.4.1 /builtins.def (unfollow)
Commit message (Collapse)Author
2020-03-03Use getopts in shell scriptsJune McEnroe
WTF why did no one tell me about this?
2020-02-27Style %T outside of Rs in italicJune McEnroe
2020-02-26Add Fierce Femmes and Notorious LiarsJune McEnroe
2020-02-23Add This Is How You Lose the Time WarJune McEnroe
2020-02-22Add See Ya LaterJune McEnroe
2020-02-20Remove wiki scriptJune McEnroe
Wikipedia seems to have removed the one-sentence extracts from the opensearch results. Too bad. It's not a wiki script, what we need is a command that fetches single-sentence summaries of articles on Wikipedia.
2020-02-19Add The Obelisk GateJune McEnroe
2020-02-17Add Four Tet — HandsJune McEnroe
One from the cafe that caught my attention.
2020-02-12Simplify macOS notify-sendJune McEnroe
2020-02-12Add imbox and notemap to pageJune McEnroe
2020-02-12Collapse simple linksJune McEnroe
2020-02-12Move catgirl up the pageJune McEnroe
2020-02-12Update catgirl pty grabJune McEnroe
2020-02-12Link to cgit /about pages where appropriateJune McEnroe
2020-02-11Separate LINKS from BINS for html to workJune McEnroe
2020-02-11Add margin to Bl-bullet itemsJune McEnroe
2020-02-10Match URLs inside parens or with paired parens insideJune McEnroe
2020-02-10Duplicate effective URL before passing it back to curlJune McEnroe
Apparently sometimes it didn't like receiving its own internal storage to parse again. Understandable.
2020-02-09Add To Be Taught, If FortunateJune McEnroe
2020-02-04Add The Future of Another TimelineJune McEnroe
Wow. One of the best I've read.
2020-01-31Reorganize the Makefile for the umpteenth timeJune McEnroe
Broke out LDLIBS for each bin, and made everything more uniform.
2020-01-28Change scout sensitivity to 1.4June McEnroe
idk it seems to work.
2020-01-28Import shows.txtJune McEnroe