view mercurial/strutil.py @ 15004:d06b9c55ddab stable

hgweb: raw file mimetype guessing configurable, off by default (BC) (issue2923)

Before: hgweb made it possible to download file content with a content type
detected from the file extension. It would serve .html files as text/html and
could thus cause XSS vulnerabilities if the web site had any kind of session
authorization and the repository content wasn't fully trusted.

Now: all files default to "application/binary", which all important
browsers will refuse to treat as text/html. See the table here:

https://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors

# strutil.py - string utilities for Mercurial
#
# Copyright 2006 Vadim Gelfer <[e-mail]>
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.

def findall(haystack, needle, start=0, end=None):
    if end is None:
        end = len(haystack)
    if end < 0:
        end += len(haystack)
    if start < 0:
        start += len(haystack)
    while start < end:
        c = haystack.find(needle, start, end)
        if c == -1:
            break
        yield c
        start = c + 1

def rfindall(haystack, needle, start=0, end=None):
    if end is None:
        end = len(haystack)
    if end < 0:
        end += len(haystack)
    if start < 0:
        start += len(haystack)
    while end >= 0:
        c = haystack.rfind(needle, start, end)
        if c == -1:
            break
        yield c
        end = c - 1