From b67c94318ec85722ce01c03955d6fbf50e3f7aa9 Mon Sep 17 00:00:00 2001
From: "Andrew M. Kuchling" <amk@amk.ca>
Date: Wed, 31 Mar 2004 20:17:56 +0000
Subject: [Bugfix candidate] Escape traceback type and value.  There are
 probably additional cases where cgitb.py doesn't escape as paranoidly as it
 should (e.g. attribute names)

---
 Lib/cgitb.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Lib/cgitb.py b/Lib/cgitb.py
index cd469ad..ab4c598 100644
--- a/Lib/cgitb.py
+++ b/Lib/cgitb.py
@@ -146,7 +146,8 @@ function calls leading up to the error, in the order they occurred.'''
 <table width="100%%" cellspacing=0 cellpadding=0 border=0>
 %s</table>''' % '\n'.join(rows))
 
-    exception = ['<p>%s: %s' % (strong(str(etype)), str(evalue))]
+    exception = ['<p>%s: %s' % (strong(pydoc.html.escape(str(etype))),
+                                pydoc.html.escape(str(evalue)))]
     if type(evalue) is types.InstanceType:
         for name in dir(evalue):
             if name[:1] == '_': continue
-- 
cgit v0.12