Pin the advisory classes with tests and name an empty author

Each class behind cgit's published advisories now has a check against
the current code, from a newline in a file name to shell syntax handed
to a filter. The feed also treated an ident with an empty name and an
empty address as present and wrote an empty person, which Atom forbids.

1 file changed, 10 insertions, 6 deletions

diff --git a/source/ui-atom.c b/source/ui-atom.c
index b536437..39cadb8 100644
--- a/source/ui-atom.c
+++ b/source/ui-atom.c
@@ -88,9 +88,12 @@ static void print_email(const char *email)
 	if (end)
 		*end = '\0';
 
-	html("<email>");
-	xml_txt(start);
-	html("</email>\n");
+	// An empty element is no address at all, which Atom forbids.
+	if (*start) {
+		html("<email>");
+		xml_txt(start);
+		html("</email>\n");
+	}
 	free(copy);
 }
 
@@ -111,11 +114,12 @@ static void print_entry(struct commit *commit, const char *host)
 	html("</updated>\n");
 	html("<author>\n");
 	// A person construct must hold a name, so a nameless commit falls
-	// back to the address and then to a placeholder.
+	// back to the address and then to a placeholder. An ident may carry
+	// an empty name and an empty address, which count as missing.
 	html("<name>");
-	if (info->author)
+	if (info->author && *info->author)
 		xml_txt(info->author);
-	else if (info->author_email)
+	else if (info->author_email && strcmp(info->author_email, "<>"))
 		xml_txt(info->author_email);
 	else
 		html("unknown");