Hacker News Reader

Comment by falsedan | Hacker News Reader

    git log --pretty=format:"%H%x00%s" | sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g; s/"/\&quot;/g; s/'"'"'/\&#39;/g; s@\(.*\)\x0\(.*\)@<tr><th>\1</th><td>\2</td></tr>@'

You could do the dumb html entifying in a real language. The article's solution is a straw man, since it's promoting their personal language.

Why did they see \x01 & \x02 as possible sentinels but not nulls? python is fine with nulls…

View on HN

My solution is easier with respect to multiple fields that contain spaces. The real example has both the description and committer name. And you can add and remove fields without changing the second part of the pipeline -- you just have to add 0x00 and 0x01 in the format string.

Similar qusetion here:

https://www.reddit.com/r/commandline/comments/719pm2/how_to_...

Also, I've used that kind of sed, and it looks horrible. It makes shell look bad.

> You could do the dumb html entifying in a real language

and xargs -0 -n2 printf '<tr><th>%s</th><td>%s</td></tr>'

People always underestimate the power of utilities specified in POSIX. When you want to do text processing without dependencies (which seem to be the goal here), just use awk.

cgi.escape is just this:

    def escape(s, quote=None):
        '''Replace special characters "&", "<" and ">" to HTML-safe sequences.
        If the optional flag quote is true, the quotation mark character (")
        is also translated.'''
        s = s.replace("&", "&amp;") # Must be done first!
        s = s.replace("<", "&lt;")
        s = s.replace(">", "&gt;")
        if quote:
            s = s.replace('"', "&quot;")
        return s

And the author would simplify the job as you point out by escaping the git log output first, then wrapping it in HTML. You don't even need the null byte. %H is a hex sequence, so even a space separator would be fine. This would do:

    git log --pretty='%H %s' |
    sed -e '
      s/&/\&amp;/g;  # must be done first
      s/</\&lt;/g;
      s/>/\&gt;/g;
      s/^\([0-9a-f][0-9a-f]*\) \(.*\)/<tr><td>\1<\/td><td>\2<\/td><\/tr>/'

That said: it's best not to be cavalier about dealing with user input. This is sufficient only if the output is going into the body of the HTML document. You have to be careful about where the output is being placed:

https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%...

I addressed this here -- that solution doesn't really work with multiple fields that contain spaces:

https://www.reddit.com/r/commandline/comments/719pm2/how_to_...

I admit at that point you might want to break out perl:

    git log --pretty='format:%H%x00%an%x00%aE%x00%s' |
    perl -F'\0' -ane '
    chomp;
    print "<tr>\n";
    foreach(@F) {
      s|&|&amp;|g;
      s|<|&lt;|g;
      s|>|&gt;|g;
      print "<td>$_</td>\n";
    }
    print "</tr>\n"'

Reply on news.ycombinator.com