diff options
| -rw-r--r-- | Lib/cgitb.py | 3 | ||||
| -rw-r--r-- | Misc/NEWS | 4 |
2 files changed, 6 insertions, 1 deletions
diff --git a/Lib/cgitb.py b/Lib/cgitb.py index 1c300b2..19b4149 100644 --- a/Lib/cgitb.py +++ b/Lib/cgitb.py @@ -183,7 +183,8 @@ function calls leading up to the error, in the order they occurred.</p>''' %s --> -''' % ''.join(traceback.format_exception(etype, evalue, etb)) +''' % pydoc.html.escape( + ''.join(traceback.format_exception(etype, evalue, etb))) def text((etype, evalue, etb), context=5): """Return a plain text document describing a given traceback.""" @@ -12,6 +12,10 @@ What's New in Python 2.5.2c1? Library ------- +- HTML-escape the plain traceback in cgitb's HTML output, to prevent + the traceback inadvertently or maliciously closing the comment and + injecting HTML into the error page. + - Bug #1290505: Properly clear time.strptime's locale cache when the locale changes between calls. Backport of r54646 and r54647. |