commit 65559f29d05d29688f1aaca93a9398148be5154b
from: Tracey Emery <tracey@traceyemery.net>
date: Fri Jan 24 20:43:51 2020 UTC

html escape diff output

commit - 2ac037ec8ba78bc3bf1dbbaf7b52956792102347
commit + 65559f29d05d29688f1aaca93a9398148be5154b
blob - 3f4028774c3e25154a5b3c87c5ccf0a821ec20e5
blob + ac0b83d3a21a5564bb3eda6f20f55e31f684cce9
--- gotweb/gotweb.c
+++ gotweb/gotweb.c
@@ -1287,7 +1287,7 @@ gw_get_diff(struct gw_trans *gw_trans, struct gw_heade
 	struct got_object_id *id1 = NULL, *id2 = NULL;
 	struct buf *diffbuf = NULL;
 	char *label1 = NULL, *label2 = NULL, *diff_html = NULL, *buf = NULL,
-	     *buf_color = NULL;
+	     *buf_color = NULL, *n_buf = NULL, *newline = NULL;
 	int type1, type2;
 	size_t newsize;
 
@@ -1349,7 +1349,14 @@ gw_get_diff(struct gw_trans *gw_trans, struct gw_heade
 	fseek(f, 0, SEEK_SET);
 
 	while ((fgets(buf, 128, f)) != NULL) {
-		buf_color = gw_colordiff_line(buf);
+		n_buf = buf;
+		while (*n_buf == '\n')
+			n_buf++;
+		newline = strchr(n_buf, '\n');
+		if (newline)
+			*newline = ' ';
+
+		buf_color = gw_colordiff_line(gw_html_escape(n_buf));
 		error = buf_puts(&newsize, diffbuf, buf_color);
 		if (error)
 			return NULL;