gitweb: Harden "grep" search against filenames with ':'

[git.git] / gitweb / gitweb.perl
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl

index a95226e089fa22d7041e4374382bb2709da10df1..08020b0776bf9d7da98080041235c42d8fecd03f 100755 (executable)
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -85,6 +85,8 @@ our $home_link_str = "++GITWEB_HOME_LINK_STR++";
  our $site_name = "++GITWEB_SITENAME++"
                   || ($ENV{'SERVER_NAME'} || "Untitled") . " Git";
  
+# html snippet to include in the <head> section of each page
+our $site_html_head_string = "++GITWEB_SITE_HTML_HEAD_STRING++";
  # filename of html text to include at top of each page
  our $site_header = "++GITWEB_SITE_HEADER++";
  # html text to include at home page
@@ -3879,6 +3881,11 @@ EOF
                 print "<base href=\"".esc_url($base_url)."\" />\n";
         }
         print_header_links($status);
+
+       if (defined $site_html_head_string) {
+               print to_utf8($site_html_head_string);
+       }
+
         print "</head>\n" .
               "<body>\n";
  
@@ -5692,7 +5699,7 @@ sub git_search_files {
         my %co = @_;
  
         local $/ = "\n";
-       open my $fd, "-|", git_cmd(), 'grep', '-n',
+       open my $fd, "-|", git_cmd(), 'grep', '-n', '-z',
                 $search_use_regexp ? ('-E', '-i') : '-F',
                 $searchtext, $co{'tree'}
                         or die_error(500, "Open git-grep failed");
@@ -5708,13 +5715,14 @@ sub git_search_files {
         my $lastfile = '';
         while (my $line = <$fd>) {
                 chomp $line;
-               my ($file, $lno, $ltext, $binary);
+               my ($file, $file_href, $lno, $ltext, $binary);
                 last if ($matches++ > 1000);
                 if ($line =~ /^Binary file (.+) matches$/) {
                         $file = $1;
                         $binary = 1;
                 } else {
-                       (undef, $file, $lno, $ltext) = split(/:/, $line, 4);
+                       ($file, $lno, $ltext) = split(/\0/, $line, 3);
+                       $file =~ s/^$co{'tree'}://;
                 }
                 if ($file ne $lastfile) {
                         $lastfile and print "</td></tr>\n";
@@ -5723,10 +5731,10 @@ sub git_search_files {
                         } else {
                                 print "<tr class=\"light\">\n";
                         }
+                       $file_href = href(action=>"blob", hash_base=>$co{'id'},
+                                         file_name=>$file);
                         print "<td class=\"list\">".
-                               $cgi->a({-href => href(action=>"blob", hash=>$co{'hash'},
-                                                      file_name=>"$file"),
-                                       -class => "list"}, esc_path($file));
+                               $cgi->a({-href => $file_href, -class => "list"}, esc_path($file));
                         print "</td><td>\n";
                         $lastfile = $file;
                 }
@@ -5744,10 +5752,9 @@ sub git_search_files {
                                 $ltext = esc_html($ltext, -nbsp=>1);
                         }
                         print "<div class=\"pre\">" .
-                               $cgi->a({-href => href(action=>"blob", hash=>$co{'hash'},
-                                                      file_name=>"$file").'#l'.$lno,
-                                       -class => "linenr"}, sprintf('%4i', $lno))
-                               . ' ' .  $ltext . "</div>\n";
+                               $cgi->a({-href => $file_href.'#l'.$lno,
+                                       -class => "linenr"}, sprintf('%4i', $lno)) .
+                               ' ' .  $ltext . "</div>\n";
                 }
         }
         if ($lastfile) {