bpo-35603: Escape table header of make_table output that can cause potential XSS #11341
Conversation
| @@ -2036,6 +2036,10 @@ def make_table(self,fromlines,tolines,fromdesc='',todesc='',context=False, | |||
| s.append( fmt % (next_id[i],next_href[i],fromlist[i], | |||
| next_href[i],tolist[i])) | |||
| if fromdesc or todesc: | |||
| fromdesc = fromdesc.replace("&", "&").replace(">", ">") \ | |||
There was a problem hiding this comment.
Why not use html.escape()?
There was a problem hiding this comment.
I thought about the same but text which was encoded was using the logic inlined and there was some discussion in the issue about just inlining the logic to avoid dependency at https://bugs.python.org/issue914575#msg45518 which I realize now is about xml.sax and not html.
html module was also importing entities at
Line 6 in c465682
html.escape across the module to avoid duplicate code.
There was a problem hiding this comment.
Well, for a bug fix we can keep an inlined code and consider using html.escape() in a separate issue.
There was a problem hiding this comment.
Sure, thanks for the review.
| @@ -2036,6 +2036,10 @@ def make_table(self,fromlines,tolines,fromdesc='',todesc='',context=False, | |||
| s.append( fmt % (next_id[i],next_href[i],fromlist[i], | |||
| next_href[i],tolist[i])) | |||
| if fromdesc or todesc: | |||
| fromdesc = fromdesc.replace("&", "&").replace(">", ">") \ | |||
There was a problem hiding this comment.
Well, for a bug fix we can keep an inlined code and consider using html.escape() in a separate issue.
serhiy-storchaka
added
type-bug
|
Thanks @tirkarthi for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7. |
|
GH-11353 is a backport of this pull request to the 3.7 branch. |
…tential XSS. (pythonGH-11341) (cherry picked from commit 78de011) Co-authored-by: Xtreak <tir.karthi@gmail.com>
|
GH-11354 is a backport of this pull request to the 3.6 branch. |
…tential XSS. (pythonGH-11341) (cherry picked from commit 78de011) Co-authored-by: Xtreak <tir.karthi@gmail.com>
fromdescandtodescshould be escaped since rendering unescaped HTML might lead to code execution in the browser rendering them as tags.https://bugs.python.org/issue35603