Mercurial > p > roundup > code
annotate roundup/anypy/html.py @ 8365:4ac0bbb3e440
bug(security): CVE-2025-53865 - XSS bug
Extensive fixes in devel, responsive templates known to be
exploitable.
Similar constructs in classic and minimal templates not known
to be exploitable, but changed anyway.
doc/upgrading.txt:
Reformat to 66 characters.
Update with assigned CVE number.
Add section on fixing tal:replace with unsafe data.
Document analysis and assumptions in comment in file.
doc/security.txt:
Update with CVE number.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Fri, 11 Jul 2025 19:30:27 -0400 |
| parents | 7f888f046857 |
| children |
| rev | line source |
|---|---|
|
5837
883c9e90b403
Fix problem with cgi.escape being depricated a different way. This way
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
1 try: |
|
6027
ff57db595a58
flake8 cleanups whitespace formatting only.
John Rouillard <rouilj@ieee.org>
parents:
5837
diff
changeset
|
2 from html import escape as html_escape_ # python 3 |
|
ff57db595a58
flake8 cleanups whitespace formatting only.
John Rouillard <rouilj@ieee.org>
parents:
5837
diff
changeset
|
3 |
|
7769
7f888f046857
chore: ruff lint: replace str variable name with string
John Rouillard <rouilj@ieee.org>
parents:
6027
diff
changeset
|
4 def html_escape(string, quote=False): |
|
5837
883c9e90b403
Fix problem with cgi.escape being depricated a different way. This way
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
5 # html_escape under python 3 sets quote to true by default |
|
883c9e90b403
Fix problem with cgi.escape being depricated a different way. This way
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
6 # make it python 2 compatible |
|
7769
7f888f046857
chore: ruff lint: replace str variable name with string
John Rouillard <rouilj@ieee.org>
parents:
6027
diff
changeset
|
7 return html_escape_(string, quote=quote) |
|
5837
883c9e90b403
Fix problem with cgi.escape being depricated a different way. This way
John Rouillard <rouilj@ieee.org>
parents:
diff
changeset
|
8 except ImportError: |
|
6027
ff57db595a58
flake8 cleanups whitespace formatting only.
John Rouillard <rouilj@ieee.org>
parents:
5837
diff
changeset
|
9 # python 2 fallback |
|
ff57db595a58
flake8 cleanups whitespace formatting only.
John Rouillard <rouilj@ieee.org>
parents:
5837
diff
changeset
|
10 from cgi import escape as html_escape # noqa: F401 |