From a09a96a5440144f926c69250dab7b9bbf06bd789 Mon Sep 17 00:00:00 2001 From: Georg Brandl Date: Tue, 15 May 2007 20:19:34 +0000 Subject: HTML-escape the plain traceback in cgitb's HTML output, to prevent the traceback inadvertently or maliciously closing the comment and injecting HTML into the error page. --- Lib/cgitb.py | 3 ++- Misc/NEWS | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/Lib/cgitb.py b/Lib/cgitb.py index 1c300b2..19b4149 100644 --- a/Lib/cgitb.py +++ b/Lib/cgitb.py @@ -183,7 +183,8 @@ function calls leading up to the error, in the order they occurred.

''' %s --> -''' % ''.join(traceback.format_exception(etype, evalue, etb)) +''' % pydoc.html.escape( + ''.join(traceback.format_exception(etype, evalue, etb))) def text((etype, evalue, etb), context=5): """Return a plain text document describing a given traceback.""" diff --git a/Misc/NEWS b/Misc/NEWS index 32531f6..79db74a 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -207,6 +207,10 @@ Core and builtins Library ------- +- HTML-escape the plain traceback in cgitb's HTML output, to prevent + the traceback inadvertently or maliciously closing the comment and + injecting HTML into the error page. + - The popen2 module and os.popen* are deprecated. Use the subprocess module. - Added an optional credentials argument to SMTPHandler, for use with SMTP -- cgit v0.12