Return-Path: X-Original-To: notmuch@notmuchmail.org Delivered-To: notmuch@notmuchmail.org Received: from localhost (localhost [127.0.0.1]) by olra.theworths.org (Postfix) with ESMTP id 19A31431FBD for ; Mon, 10 Feb 2014 10:45:06 -0800 (PST) X-Virus-Scanned: Debian amavisd-new at olra.theworths.org X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "References" X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=disabled Received: from olra.theworths.org ([127.0.0.1]) by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rz07LLOJSNRT for ; Mon, 10 Feb 2014 10:45:00 -0800 (PST) Received: from qmta09.westchester.pa.mail.comcast.net (qmta09.westchester.pa.mail.comcast.net [76.96.62.96]) by olra.theworths.org (Postfix) with ESMTP id 68578429E3F for ; Mon, 10 Feb 2014 10:44:02 -0800 (PST) Received: from omta04.westchester.pa.mail.comcast.net ([76.96.62.35]) by qmta09.westchester.pa.mail.comcast.net with comcast id Qd6M1n0030ldTLk59ik2ML; Mon, 10 Feb 2014 18:44:02 +0000 Received: from odin.tremily.us ([24.18.63.50]) by omta04.westchester.pa.mail.comcast.net with comcast id Qii11n00F152l3L01ii1x1; Mon, 10 Feb 2014 18:42:02 +0000 Received: from mjolnir.tremily.us (unknown [192.168.0.140]) by odin.tremily.us (Postfix) with ESMTPS id 0234010167C7; Mon, 10 Feb 2014 10:42:01 -0800 (PST) Received: (nullmailer pid 1285 invoked by uid 1000); Mon, 10 Feb 2014 18:40:46 -0000 From: "W. Trevor King" To: notmuch@notmuchmail.org Subject: [PATCH v2 19/20] nmbug-status: Escape &, <, and > in HTML display data Date: Mon, 10 Feb 2014 10:40:40 -0800 Message-Id: <12913effee843bd0edb90829f2a697fefc5715b1.1392056624.git.wking@tremily.us> X-Mailer: git-send-email 1.8.5.2.8.g0f6c0d1 In-Reply-To: References: In-Reply-To: References: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20121106; t=1392057842; bh=JkclE6rFHN+/nSNV2UZNQWAAGqczyXMc3ejEIf4/27E=; h=Received:Received:Received:Received:From:To:Subject:Date: Message-Id; b=PhdcK6lIRhqN0lTREV4tUMt7lpT6PQrYy1DYlt6+4o7n6oMZVawOJH3nKKx5CrNPl j67IYaUzBT6JyHd6l6W44nwHj/ZJD581PGyDWK9kmrIkXEXpW/5WotcR3S8S5rMu1G 0aKpKj7xVsWiw71Z2x8pqN7g8LQ+iEmnaIbkkPxsyyfz0eYrLknxoksD62I4SL2VD7 i/S3+PuNrw0lFt5D/kMsfUYijmeSrM12tbQcLhvvIB6k4hJBgPlNtiXKLzhP8ip2CA W79znEpX5tQk1Vrs7F/BltvHJ0+MWIdT2w5kjNI9W7OcNWQKvdmiMbWk7hR7VzhiLa wZT8SVv69Gl9A== Cc: Tomi Ollila X-BeenThere: notmuch@notmuchmail.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Feb 2014 18:45:06 -0000 'message-id' and 'from' now have sensitive characters escaped using xml.sax.saxutils.escape [1]. The 'subject' data was already being converted to a link into Gmane; I've escape()d that too, so it doesn't need to be handled ain the same block as 'message-id' and 'from'. This prevents broken HTML by if subjects etc. contain characters that would otherwise be interpreted as HTML markup. [1]: http://docs.python.org/3/library/xml.sax.utils.html#xml.sax.saxutils.escape --- devel/nmbug/nmbug-status | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/devel/nmbug/nmbug-status b/devel/nmbug/nmbug-status index 1f0873a..7209dd1 100755 --- a/devel/nmbug/nmbug-status +++ b/devel/nmbug/nmbug-status @@ -24,6 +24,7 @@ import os import re import sys import subprocess +import xml.sax.saxutils _ENCODING = locale.getpreferredencoding() or sys.getdefaultencoding() @@ -229,11 +230,14 @@ class HtmlPage (Page): if 'subject' in display_data and 'message-id' in display_data: d = { 'message-id': quote(display_data['message-id']), - 'subject': display_data['subject'], + 'subject': xml.sax.saxutils.escape(display_data['subject']), } display_data['subject'] = ( '{subject}' ).format(**d) + for key in ['message-id', 'from']: + if key in display_data: + display_data[key] = xml.sax.saxutils.escape(display_data[key]) return (running_data, display_data) def _slug(self, string): -- 1.8.5.2.8.g0f6c0d1