From 1e25ac5b8fe0ca8760b2786b20d36013a6197e02 Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Thu, 21 Jul 2011 23:04:53 +0200 Subject: Remove dead initialization in cgit_parse_commit() The value stored to "t" during its initialization gets overwritten in any case, so just leave it uninitialized. Spotted by clang-analyzer. Signed-off-by: Lukas Fleischer Signed-off-by: Lars Hjemli --- parsing.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/parsing.c b/parsing.c index 151c0fe..602e3de 100644 --- a/parsing.c +++ b/parsing.c @@ -125,7 +125,7 @@ const char *reencode(char **txt, const char *src_enc, const char *dst_enc) struct commitinfo *cgit_parse_commit(struct commit *commit) { struct commitinfo *ret; - char *p = commit->buffer, *t = commit->buffer; + char *p = commit->buffer, *t; ret = xmalloc(sizeof(*ret)); ret->commit = commit; -- cgit v1.2.3-2-gb3c3 From bebe89d7c11a92bf206bf6e528c51ffa8ecbc0d5 Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Fri, 22 Jul 2011 13:47:19 +0200 Subject: Fix potential XSS vulnerability in rename hint The file name displayed in the rename hint should be escaped to avoid XSS. Note that this vulnerability is only applicable when an attacker has gained push access to the repository. Signed-off-by: Lukas Fleischer Signed-off-by: Lars Hjemli --- ui-diff.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/ui-diff.c b/ui-diff.c index d21541b..383a534 100644 --- a/ui-diff.c +++ b/ui-diff.c @@ -97,10 +97,12 @@ static void print_fileinfo(struct fileinfo *info) htmlf("", class); cgit_diff_link(info->new_path, NULL, NULL, ctx.qry.head, ctx.qry.sha1, ctx.qry.sha2, info->new_path, 0); - if (info->status == DIFF_STATUS_COPIED || info->status == DIFF_STATUS_RENAMED) - htmlf(" (%s from %s)", - info->status == DIFF_STATUS_COPIED ? "copied" : "renamed", - info->old_path); + if (info->status == DIFF_STATUS_COPIED || info->status == DIFF_STATUS_RENAMED) { + htmlf(" (%s from ", + info->status == DIFF_STATUS_COPIED ? "copied" : "renamed"); + html_txt(info->old_path); + html(")"); + } html(""); if (info->binary) { htmlf("bin%ld -> %ld bytes", -- cgit v1.2.3-2-gb3c3