From 42adaa11aa0a66645d4cf94488c88660cea00c41 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Mon, 21 Sep 2026 21:34:12 -1000
Subject: Harden the page renderers

---
 source/ui-blame.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

(limited to 'source/ui-blame.c')

diff --git a/source/ui-blame.c b/source/ui-blame.c
index 7248120..c020dbc 100644
--- a/source/ui-blame.c
+++ b/source/ui-blame.c
@@ -17,10 +17,6 @@
 #include "ui-blame.h"
 #include "ui-shared.h"
 
-// A tab in the rendered source runs on to the next multiple of this,
-// matching what the browser does on its own since tab-size is left alone.
-#define TAB_WIDTH 8
-
 enum blame_target {
 	TARGET_MISSING,
 	TARGET_FILE,
@@ -116,14 +112,15 @@ static char *suspect_detail(struct blame_origin *suspect)
 
 	info = cgit_parse_commit(suspect->commit);
 
-	strbuf_addf(&detail, "author  %s", info->author);
-	if (ctx.cfg.enable_plain_email)
+	// A commit object may lack either ident line, leaving the fields NULL.
+	strbuf_addf(&detail, "author  %s", info->author ? info->author : "");
+	if (ctx.cfg.enable_plain_email && info->author_email)
 		strbuf_addf(&detail, " %s", info->author_email);
 	strbuf_addf(&detail, "  %s\n",
 		show_date(info->author_date, info->author_tz, cgit_date_mode(DATE_ISO8601)));
 
-	strbuf_addf(&detail, "committer  %s", info->committer);
-	if (ctx.cfg.enable_plain_email)
+	strbuf_addf(&detail, "committer  %s", info->committer ? info->committer : "");
+	if (ctx.cfg.enable_plain_email && info->committer_email)
 		strbuf_addf(&detail, " %s", info->committer_email);
 	strbuf_addf(&detail, "  %s\n\n",
 		show_date(info->committer_date, info->committer_tz, cgit_date_mode(DATE_ISO8601)));
@@ -179,12 +176,12 @@ static void emit_hashes(struct blame_scoreboard *sb)
 
 static void emit_entry_linenumbers(struct blame_entry *ent)
 {
-	const char *numberfmt = "<a id='n%1$d' href='#n%1$d'>%1$d</a>\n";
 	struct strbuf numbers = STRBUF_INIT;
 	int lineno = ent->lno;
 
 	while (lineno < ent->lno + ent->num_lines) {
-		strbuf_addf(&numbers, numberfmt, ++lineno);
+		lineno++;
+		strbuf_addf(&numbers, "<a id='n%d' href='#n%d'>%d</a>\n", lineno, lineno, lineno);
 		if (numbers.len >= HTML_BATCH) {
 			html_raw(numbers.buf, numbers.len);
 			strbuf_reset(&numbers);
@@ -274,7 +271,7 @@ static void print_blame_page(const struct object_id *oid, const char *path,
 
 	type = odb_read_object_info(the_repository->objects, oid, &size);
 	if (type == OBJ_BAD) {
-		cgit_print_error_page(404, "Not Found", "Bad object name: %s", oid_to_hex(oid));
+		cgit_print_error_page(404, "Not Found", "Bad object id: %s", oid_to_hex(oid));
 		return;
 	}
 	if (ctx.cfg.max_blob_size && size / 1024 > (unsigned long)ctx.cfg.max_blob_size) {
@@ -287,7 +284,8 @@ static void print_blame_page(const struct object_id *oid, const char *path,
 
 	buf = odb_read_object(the_repository->objects, oid, &type, &size);
 	if (!buf) {
-		cgit_print_error_page(500, "Internal Server Error", "Error reading object %s", oid_to_hex(oid));
+		cgit_print_error_page(500, "Internal Server Error", "Unable to read object %s",
+			oid_to_hex(oid));
 		return;
 	}
 
@@ -333,6 +331,7 @@ static void print_blame_page(const struct object_id *oid, const char *path,
 	html("<pre><code>");
 	if (ctx.repo->source_filter) {
 		char *filter_arg = xstrdup(filename);
+
 		cgit_open_filter(ctx.repo->source_filter, filter_arg);
 		html_raw(buf, size);
 		cgit_close_filter(ctx.repo->source_filter);
@@ -412,12 +411,12 @@ void cgit_print_blame(void)
 		rev = ctx.qry.head;
 
 	if (repo_get_oid(the_repository, rev, &oid)) {
-		cgit_print_error_page(404, "Not Found", "Invalid revision name: %s", rev);
+		cgit_print_error_page(404, "Not Found", "Bad object id: %s", rev);
 		return;
 	}
 	commit = lookup_commit_reference(the_repository, &oid);
 	if (!commit || repo_parse_commit(the_repository, commit)) {
-		cgit_print_error_page(404, "Not Found", "Invalid commit reference: %s", rev);
+		cgit_print_error_page(404, "Not Found", "Not a commit: %s", rev);
 		return;
 	}
 
@@ -428,7 +427,7 @@ void cgit_print_blame(void)
 	if (walk.found == TARGET_MISSING)
 		cgit_print_error_page(404, "Not Found", "Not found");
 	else if (walk.found == TARGET_FOLDER)
-		cgit_print_error_page(404, "Not Found", "Blame is not available for folders.");
+		cgit_print_error_page(404, "Not Found", "Blame is not available for a directory");
 
 	free(walk.rev);
 }
-- 
cgit v2.8.0