traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

HTML-escape the plain traceback in cgitb's HTML output, to prevent 

the traceback inadvertently or maliciously closing the comment and
injecting HTML into the error page.
 (backport from rev. 55348)
This commit is contained in:
Georg Brandl 2007-05-15 20:19:39 +00:00
parent 0d338e4bc6
commit 4c87581c32
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Lib/cgitb.py
View File

@ -183,7 +183,8 @@ function calls leading up to the error, in the order they occurred.</p>'''
%s
-->
''' % ''.join(traceback.format_exception(etype, evalue, etb))
''' % pydoc.html.escape(
''.join(traceback.format_exception(etype, evalue, etb)))
def text((etype, evalue, etb), context=5):
"""Return a plain text document describing a given traceback."""

4
Misc/NEWS
View File

@ -12,6 +12,10 @@ What's New in Python 2.5.2c1?
Library
-------
- HTML-escape the plain traceback in cgitb's HTML output, to prevent
the traceback inadvertently or maliciously closing the comment and
injecting HTML into the error page.
- Bug #1290505: Properly clear time.strptime's locale cache when the locale
changes between calls. Backport of r54646 and r54647.