HTML-escape the plain traceback in cgitb's HTML output, to prevent

the traceback inadvertently or maliciously closing the comment and
injecting HTML into the error page.
 (backport from rev. 55348)

diff --git a/Lib/cgitb.py b/Lib/cgitb.py
index a52800afef55d361e3270a8db343aea97041c9cf..86e4eb9a2eaad26a2852a9e7a7d7c6576f638142 100644 (file)
--- a/Lib/cgitb.py
+++ b/Lib/cgitb.py
@@ -182,7 +182,8 @@ function calls leading up to the error, in the order they occurred.</p>'''
 
 %s
 -->
-''' % ''.join(traceback.format_exception(etype, evalue, etb))
+''' % pydoc.html.escape(
+          ''.join(traceback.format_exception(etype, evalue, etb)))
 
 def text((etype, evalue, etb), context=5):
     """Return a plain text document describing a given traceback."""

diff --git a/Misc/NEWS b/Misc/NEWS
index 280b6aa34936dbe21c784b1990660ba5998e4025..e8ea8cc01a5895dd9f847c21eabd2cc13c5ad74d 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -26,6 +26,10 @@ Extension Modules
 Library
 -------
 
+- HTML-escape the plain traceback in cgitb's HTML output, to prevent
+  the traceback inadvertently or maliciously closing the comment and
+  injecting HTML into the error page.
+
 - idle: Honor the "Cancel" action in the save dialog (Debian bug #299092).
 
 Tests