Subject: Re: [PATCH] gitweb: Provide title attributes for abbreviated author names.

From: "Shawn O. Pearce" <[email-masked]>
Date: Sat, 20 Oct 2007 23:25:33 -0400

Nice, but...

David Symonds <[email-masked]> wrote:
> +++ b/gitweb/gitweb.perl
> @@ -3461,9 +3461,15 @@ sub git_shortlog_body {
>  			print "<tr class=\"light\">\n";
>  		}
>  		$alternate ^= 1;
> +		my $author = chop_str($co{'author_name'}, 10);
> +		if ($author ne $co{'author_name'}) {
> +			$author = "<span title=\"$co{'author_name'}\">" . esc_html($author) . "</span>";

Doesn't this produce invalid HTML if $co{'author_name'} has a special
HTML character in it such as & or "?  Note that " is much more likely
as it is often used for nicknames.  The old code properly escaped
the author name, and indeed you are doing it for the abbreviated
version but not the full version.

This bug seemed to exist in almost all (if not all) of the hunks.

-- 
Shawn.