From a37bfbbee2bf503883b75381940c7419cf65ad87 Mon Sep 17 00:00:00 2001
From: James Taliaferro <taliaferro1@llnl.gov>
Date: Sep 25 2024 17:39:30 +0000
Subject: Escape HTML tag characters in the query string


Currently, the fields in the query string are not sanitized for special
characters; using html.escape() we can remove HTML tag characters to prevent
them from making their way back out into the rendered template.

---

diff --git a/www/kojiweb/wsgi_publisher.py b/www/kojiweb/wsgi_publisher.py
index 8f5de4b..a9e1bee 100644
--- a/www/kojiweb/wsgi_publisher.py
+++ b/www/kojiweb/wsgi_publisher.py
@@ -20,6 +20,7 @@
 #       Mike McLean <mikem@redhat.com>
 
 import cgi
+import html
 import inspect
 import logging
 import os.path
@@ -250,7 +251,7 @@ class Dispatcher(object):
             if field.filename:
                 val = field
             else:
-                val = field.value
+                val = html.escape(field.value)
             data.setdefault(field.name, []).append(val)
         # replace singleton lists with single values
         # XXX - this is a bad practice, but for now we strive to emulate mod_python.publisher