[PATCH v3 5/8] nmbug-status: Escape &, <, and > in HTML display data

diff --git a/96/22d8676650e75e3335b1a8f4f712093428150d b/96/22d8676650e75e3335b1a8f4f712093428150d
new file mode 100644 (file)
index 0000000..bd728e3
--- /dev/null
+++ b/96/22d8676650e75e3335b1a8f4f712093428150d
@@ -0,0 +1,114 @@
+Return-Path: <wking@tremily.us>\r
+X-Original-To: notmuch@notmuchmail.org\r
+Delivered-To: notmuch@notmuchmail.org\r
+Received: from localhost (localhost [127.0.0.1])\r
+       by olra.theworths.org (Postfix) with ESMTP id B4067431FDC\r
+       for <notmuch@notmuchmail.org>; Thu, 13 Feb 2014 08:51:06 -0800 (PST)\r
+X-Virus-Scanned: Debian amavisd-new at olra.theworths.org\r
+X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "References"\r
+X-Spam-Flag: NO\r
+X-Spam-Score: 0\r
+X-Spam-Level: \r
+X-Spam-Status: No, score=0 tagged_above=-999 required=5\r
+       tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001]\r
+       autolearn=disabled\r
+Received: from olra.theworths.org ([127.0.0.1])\r
+       by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024)\r
+       with ESMTP id g6aYuky8fGis for <notmuch@notmuchmail.org>;\r
+       Thu, 13 Feb 2014 08:50:59 -0800 (PST)\r
+Received: from QMTA11.westchester.pa.mail.comcast.net\r
+       (qmta11.westchester.pa.mail.comcast.net [76.96.59.211])\r
+       by olra.theworths.org (Postfix) with ESMTP id 525E1431FC2\r
+       for <notmuch@notmuchmail.org>; Thu, 13 Feb 2014 08:50:47 -0800 (PST)\r
+Received: from omta20.westchester.pa.mail.comcast.net ([76.96.62.71])\r
+       by QMTA11.westchester.pa.mail.comcast.net with comcast\r
+       id Rpnj1n0061YDfWL5Bsqnh7; Thu, 13 Feb 2014 16:50:47 +0000\r
+Received: from odin.tremily.us ([24.18.63.50])\r
+       by omta20.westchester.pa.mail.comcast.net with comcast\r
+       id Rsom1n002152l3L3gsomUZ; Thu, 13 Feb 2014 16:48:47 +0000\r
+Received: from mjolnir.tremily.us (unknown [192.168.0.140])\r
+       by odin.tremily.us (Postfix) with ESMTPS id A2FDF102DA08;\r
+       Thu, 13 Feb 2014 08:48:45 -0800 (PST)\r
+Received: (nullmailer pid 17991 invoked by uid 1000);\r
+       Thu, 13 Feb 2014 16:47:29 -0000\r
+From: "W. Trevor King" <wking@tremily.us>\r
+To: notmuch@notmuchmail.org\r
+Subject: [PATCH v3 5/8] nmbug-status: Escape &, <, and > in HTML display data\r
+Date: Thu, 13 Feb 2014 08:47:20 -0800\r
+Message-Id:\r
+ <d0061c00aee8405ca66118025f034fc6f9b0281b.1392309570.git.wking@tremily.us>\r
+X-Mailer: git-send-email 1.8.5.2.8.g0f6c0d1\r
+In-Reply-To: <cover.1392309570.git.wking@tremily.us>\r
+References: <cover.1392309570.git.wking@tremily.us>\r
+In-Reply-To: <cover.1392309570.git.wking@tremily.us>\r
+References: <cover.1392309570.git.wking@tremily.us>\r
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net;\r
+       s=q20121106; t=1392310247;\r
+       bh=VosB/uUJnR+iJHM9vJAxTQQkCLzOFY8hHgWpuzkG6nA=;\r
+       h=Received:Received:Received:Received:From:To:Subject:Date:\r
+       Message-Id;\r
+       b=j/Sq5EHQzKGnUT/d9GzHdgf8k9Fyzk2MYf6xU6ksYG1bUUIU0aYjGb/h80B31KKFm\r
+       X5aoRVKhoOWMIBOfkB6CfAxBto2KpHOr6anF7n2Y8WMTlPLIN5o5lDpMUR/7wy+5zQ\r
+       H19fpUIJD92FfIMPHvJwbMw5bvFm2VkZGj0GWl+mV11BHOBWsTGtVy7eSR0SnbmWv/\r
+       IN4F3hjZGrc4TwN5A2TKeZ3gKRcWxRdXoS/hJmJYksUNCY28rteFAKewdn5EdoROx0\r
+       pqNDa9Jc1f8thdEwnDAnShWqnJ6FF7Rb5Md+V3LpMqehj043zXR1Y4XG4fcKOg3YKO\r
+       Ba01YxctFsIOw==\r
+Cc: Tomi Ollila <tomi.ollila@iki.fi>\r
+X-BeenThere: notmuch@notmuchmail.org\r
+X-Mailman-Version: 2.1.13\r
+Precedence: list\r
+List-Id: "Use and development of the notmuch mail system."\r
+       <notmuch.notmuchmail.org>\r
+List-Unsubscribe: <http://notmuchmail.org/mailman/options/notmuch>,\r
+       <mailto:notmuch-request@notmuchmail.org?subject=unsubscribe>\r
+List-Archive: <http://notmuchmail.org/pipermail/notmuch>\r
+List-Post: <mailto:notmuch@notmuchmail.org>\r
+List-Help: <mailto:notmuch-request@notmuchmail.org?subject=help>\r
+List-Subscribe: <http://notmuchmail.org/mailman/listinfo/notmuch>,\r
+       <mailto:notmuch-request@notmuchmail.org?subject=subscribe>\r
+X-List-Received-Date: Thu, 13 Feb 2014 16:51:07 -0000\r
+\r
+'message-id' and 'from' now have sensitive characters escaped using\r
+xml.sax.saxutils.escape [1].  The 'subject' data was already being\r
+converted to a link into Gmane; I've escape()d that too, so it doesn't\r
+need to be handled ain the same block as 'message-id' and 'from'.\r
+\r
+This prevents broken HTML by if subjects etc. contain characters that\r
+would otherwise be interpreted as HTML markup.\r
+\r
+[1]: http://docs.python.org/3/library/xml.sax.utils.html#xml.sax.saxutils.escape\r
+---\r
+ devel/nmbug/nmbug-status | 6 +++++-\r
+ 1 file changed, 5 insertions(+), 1 deletion(-)\r
+\r
+diff --git a/devel/nmbug/nmbug-status b/devel/nmbug/nmbug-status\r
+index 92552a4..57eec6c 100755\r
+--- a/devel/nmbug/nmbug-status\r
++++ b/devel/nmbug/nmbug-status\r
+@@ -24,6 +24,7 @@ import os\r
+ import re\r
+ import sys\r
+ import subprocess\r
++import xml.sax.saxutils\r
+ \r
+ \r
+ _ENCODING = locale.getpreferredencoding() or sys.getdefaultencoding()\r
+@@ -229,11 +230,14 @@ class HtmlPage (Page):\r
+         if 'subject' in display_data and 'message-id' in display_data:\r
+             d = {\r
+                 'message-id': quote(display_data['message-id']),\r
+-                'subject': display_data['subject'],\r
++                'subject': xml.sax.saxutils.escape(display_data['subject']),\r
+                 }\r
+             display_data['subject'] = (\r
+                 '<a href="http://mid.gmane.org/{message-id}">{subject}</a>'\r
+                 ).format(**d)\r
++        for key in ['message-id', 'from']:\r
++            if key in display_data:\r
++                display_data[key] = xml.sax.saxutils.escape(display_data[key])\r
+         return (running_data, display_data)\r
+ \r
+     def _slug(self, string):\r
+-- \r
+1.8.5.2.8.g0f6c0d1\r
+\r