git » wikiri » commit e8e7412

Escape diff's output

author Alberto Bertogli
2008-12-28 23:10:04 UTC
committer Alberto Bertogli
2008-12-28 23:10:04 UTC
parent 4d4182f52ac2bf3d96349d467c97dfb75b2e3719
Escape diff's output

Otherwise we may leak out valid html.

Signed-off-by: Alberto Bertogli <albertito@blitiri.com.ar>
wikiri.cgi +3 -1 
diff --git a/wikiri.cgi b/wikiri.cgi
index 69ee175..b46bd34 100755
--- a/wikiri.cgi
+++ b/wikiri.cgi
@@ -104,6 +104,8 @@ def content2html(content):
 	return parts['body'].encode('utf8')
 
 def diff2html(diff):
+	from xml.sax.saxutils import escape
+
 	s = '<div class="diff">'
 	for l in diff.split('\n'):
 		l = l.rstrip()
@@ -119,7 +121,7 @@ def diff2html(diff):
 			c = "header"
 		else:
 			c = "other"
-		s += '<span class="%s">' % c + l + '</span>\n'
+		s += '<span class="%s">' % c + escape(l) + '</span>\n'
 		# note there's no need to put <br/>s because the div.diff has
 		# "white-space: pre" in the css
 	s += '</div>'