koji

#4199 Escape HTML tag characters in the query string
Closed by mikem. Opened by taliaferro-llnl.
taliaferro-llnl/koji kojiweb-html-escape  into  master

Download 4199.patch

Currently, the fields in the query string are not sanitized for special characters; using html.escape() we can remove HTML tag characters to prevent them from making their way back out into the rendered template.

The dispatcher is not really the right place to handle such escaping. The handlers are not expecting html-escaped strings.
Edited by mikem

Closed in favor of #4215

Pull-Request has been closed by mikem
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.