From: Georg Brandl <georg@python.org>
Date: Tue, 15 May 2007 20:19:39 +0000 (+0000)
Subject: HTML-escape the plain traceback in cgitb's HTML output, to prevent
X-Git-Tag: v2.5.2c1~298
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4c87581c328c0f0fc9cc477c62f5f1a37799ba8c;p=python

HTML-escape the plain traceback in cgitb's HTML output, to prevent
the traceback inadvertently or maliciously closing the comment and
injecting HTML into the error page.
 (backport from rev. 55348)
---

diff --git a/Lib/cgitb.py b/Lib/cgitb.py
index 1c300b24ea..19b4149f9f 100644
--- a/Lib/cgitb.py
+++ b/Lib/cgitb.py
@@ -183,7 +183,8 @@ function calls leading up to the error, in the order they occurred.</p>'''
 
 %s
 -->
-''' % ''.join(traceback.format_exception(etype, evalue, etb))
+''' % pydoc.html.escape(
+          ''.join(traceback.format_exception(etype, evalue, etb)))
 
 def text((etype, evalue, etb), context=5):
     """Return a plain text document describing a given traceback."""
diff --git a/Misc/NEWS b/Misc/NEWS
index 65e176ed83..8e8254d906 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,10 @@ What's New in Python 2.5.2c1?
 Library
 -------
 
+- HTML-escape the plain traceback in cgitb's HTML output, to prevent
+  the traceback inadvertently or maliciously closing the comment and
+  injecting HTML into the error page.
+
 - Bug #1290505: Properly clear time.strptime's locale cache when the locale
   changes between calls.  Backport of r54646 and r54647.