diff options
author | Armin Rigo <arigo@tunes.org> | 2020-09-12 10:02:35 +0200 |
---|---|---|
committer | Armin Rigo <arigo@tunes.org> | 2020-09-12 10:02:35 +0200 |
commit | f4e76aaa82f0ea08d80966c3581c282db8e43939 (patch) | |
tree | 18d5804e8079f40a6f7b0964e1d6f72a96e7ae42 /lib-python | |
parent | Test fix: workaround for limited length of UNIXAddresses (diff) | |
download | pypy-f4e76aaa82f0ea08d80966c3581c282db8e43939.tar.gz pypy-f4e76aaa82f0ea08d80966c3581c282db8e43939.tar.bz2 pypy-f4e76aaa82f0ea08d80966c3581c282db8e43939.zip |
backport bpo-38243 because it is classified as a CVE
Diffstat (limited to 'lib-python')
-rw-r--r-- | lib-python/2.7/DocXMLRPCServer.py | 13 | ||||
-rw-r--r-- | lib-python/2.7/test/test_docxmlrpc.py | 20 |
2 files changed, 32 insertions, 1 deletions
diff --git a/lib-python/2.7/DocXMLRPCServer.py b/lib-python/2.7/DocXMLRPCServer.py index 4064ec2e48..90b037dd35 100644 --- a/lib-python/2.7/DocXMLRPCServer.py +++ b/lib-python/2.7/DocXMLRPCServer.py @@ -20,6 +20,16 @@ from SimpleXMLRPCServer import (SimpleXMLRPCServer, CGIXMLRPCRequestHandler, resolve_dotted_attribute) + +def _html_escape_quote(s): + s = s.replace("&", "&") # Must be done first! + s = s.replace("<", "<") + s = s.replace(">", ">") + s = s.replace('"', """) + s = s.replace('\'', "'") + return s + + class ServerHTMLDoc(pydoc.HTMLDoc): """Class used to generate pydoc HTML document for a server""" @@ -210,7 +220,8 @@ class XMLRPCDocGenerator: methods ) - return documenter.page(self.server_title, documentation) + title = _html_escape_quote(self.server_title) + return documenter.page(title, documentation) class DocXMLRPCRequestHandler(SimpleXMLRPCRequestHandler): """XML-RPC and documentation request handler class. diff --git a/lib-python/2.7/test/test_docxmlrpc.py b/lib-python/2.7/test/test_docxmlrpc.py index 4dff4159e2..c45b892b8b 100644 --- a/lib-python/2.7/test/test_docxmlrpc.py +++ b/lib-python/2.7/test/test_docxmlrpc.py @@ -1,5 +1,6 @@ from DocXMLRPCServer import DocXMLRPCServer import httplib +import re import sys from test import test_support threading = test_support.import_module('threading') @@ -176,6 +177,25 @@ class DocXMLRPCHTTPGETServer(unittest.TestCase): self.assertIn("""Try self.<strong>add</strong>, too.""", response.read()) + def test_server_title_escape(self): + """Test that the server title and documentation + are escaped for HTML. + """ + self.serv.set_server_title('test_title<script>') + self.serv.set_server_documentation('test_documentation<script>') + self.assertEqual('test_title<script>', self.serv.server_title) + self.assertEqual('test_documentation<script>', + self.serv.server_documentation) + + generated = self.serv.generate_html_documentation() + title = re.search(r'<title>(.+?)</title>', generated).group() + documentation = re.search(r'<p><tt>(.+?)</tt></p>', generated).group() + self.assertEqual('<title>Python: test_title<script></title>', + title) + self.assertEqual('<p><tt>test_documentation<script></tt></p>', + documentation) + + def test_main(): test_support.run_unittest(DocXMLRPCHTTPGETServer) |