commit 72f61b20fc8d7744f82b7a95c8df65b38c8e8a3e
author Dave Borowitz <dborowitz@google.com> Mon Feb 06 11:08:56 2017 -0500
committer Edwin Kempin <ekempin@google.com> Tue Feb 07 09:31:10 2017 +0100
tree 192b9a65ffff849b19efc2c6bbfeaa51cd674f1a
parent e96bd74cf7c60694721d40d530cb40686232289c

ChangeUpdate: Sanitize all footers

When adding the patch set description field, we didn't remember to
sanitize the footer value, leading to I449eded0. Fix this problem more
generally by sanitizing everything that uses the addFooter method. Leave
comments about things that are appended direclty, to set a good example
for future work.

Change-Id: Icafd0d0d870a6029a28a230d21f40d0e156db427

gerrit-server/src/main/java/com/google/gerrit/server/notedb/ChangeUpdate.java

diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/notedb/ChangeUpdate.java b/gerrit-server/src/main/java/com/google/gerrit/server/notedb/ChangeUpdate.java
index 23e9fcf..c241965 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/notedb/ChangeUpdate.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/notedb/ChangeUpdate.java
@@ -600,7 +600,7 @@
     }
 
     if (subject != null) {
-      addFooter(msg, FOOTER_SUBJECT, sanitizeFooter(subject));
+      addFooter(msg, FOOTER_SUBJECT, subject);
     }
 
     if (branch != null) {
@@ -648,6 +648,7 @@
 
     for (Table.Cell<String, Account.Id, Optional<Short>> c : approvals.cellSet()) {
       addFooter(msg, FOOTER_LABEL);
+      // Label names/values are safe to append without sanitizing.
       if (!c.getValue().isPresent()) {
         msg.append('-').append(c.getRowKey());
       } else {
@@ -674,6 +675,7 @@
 
         if (rec.labels != null) {
           for (SubmitRecord.Label label : rec.labels) {
+            // Label names/values are safe to append without sanitizing.
             addFooter(msg, FOOTER_SUBMITTED_WITH)
                 .append(label.status)
                 .append(": ")
@@ -765,7 +767,7 @@
   private static void addFooter(StringBuilder sb, FooterKey footer, Object... values) {
     addFooter(sb, footer);
     for (Object value : values) {
-      sb.append(value);
+      sb.append(sanitizeFooter(Objects.toString(value)));
     }
     sb.append('\n');
   }