Re: nsedoc observations

[jah <jah () zadkiel plus com>]

On 18/08/2008 06:35, Patrick Donnelly wrote:
> I have added a usage section to a script's output. The usage tag, as I
> have been using it, is for demonstrating using the script
> (particularly args) from the command line.
>   
Like it.
> I will put adding the '\n' on my todo list. Please point out any other
> problems you encounter.
>   
I've attached a patch which fixes that old second return value from gsub
thing in @args .  It also adds newline support for @usage (but not for
multiple @usage tags - I don't think <br /> in <li> is allowed).
> This should already be possible. Please try this again and let me know
> if it still doesn't work.
>   
You're right, it does work.

It all looks good.
The only other thing I've noticed is using <foo> in function comments
(but maybe everywhere else too) where <foo> is not supposed to be html,
but is treated as such.  Anything enclosed like this appears in the html
source, but is not rendered.  I wondered if it might be a good idea to
have a whitelist for html allowed in comments - limited to basic
formatting stuff - which would solve this issue as well as enabling us
to prevent <script> <img> <iframe> <embed> etc.  Anything not in the
list would have the angle brackets turned into html entities.  Either
that, or do as is done in the nse fields and convert any and all angle
brackets.

Regards,

jah

--- file.lp.orig        2008-08-18 22:42:52.484375000 +0100
+++ file.lp     2008-08-19 00:21:53.703125000 +0100
@@ -259,7 +259,7 @@
     <% for name, desc in pairs(file_doc.args) do %>
       <h4> <%= name %> </h4>
       <p>
-        <%= desc:gsub("\\n", "<br/>") %>
+        <%= (desc:gsub("\\n", "<br/>")) %>
       </p>
     <% end %>
   </p>
@@ -269,7 +269,7 @@
   <h2> Example Usage </h2>
   <p>
     <% if type(file_doc.usage) == "string" then %>
-      <%= file_doc.usage %>
+      <%= (file_doc.usage:gsub("\\n", "<br/>")) %>
     <% else %>
       <ul>
       <% for _,v in ipairs(file_doc.usage) do %>


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org