nmbug-status: Escape &, <, and > in HTML display data

[notmuch] / devel / nmbug / nmbug-status
diff --git a/devel/nmbug/nmbug-status b/devel/nmbug/nmbug-status

index 9fde20ec786cb549c13cc349fa889e5453d31a9a..1c390e6d391de3a71c510a759d9e11e8e90be9dc 100755 (executable)
--- a/devel/nmbug/nmbug-status
+++ b/devel/nmbug/nmbug-status
@@ -24,6 +24,7 @@ import os
  import re
  import sys
  import subprocess
+import xml.sax.saxutils
  
  
  _ENCODING = locale.getpreferredencoding() or sys.getdefaultencoding()
@@ -183,14 +184,18 @@ class HtmlPage (Page):
  
      def _write_view_header(self, view, stream):
          stream.write('<h3 id="{id}">{title}</h3>\n'.format(**view))
+        stream.write('<p>\n')
          if 'comment' in view:
              stream.write(view['comment'])
              stream.write('\n')
          for line in [
                  'The view is generated from the following query:',
-                '<blockquote>',
+                '</p>',
+                '<p>',
+                '  <code>',
                  view['query-string'],
-                '</blockquote>',
+                '  </code>',
+                '</p>',
                  ]:
              stream.write(line)
              stream.write('\n')
@@ -204,7 +209,7 @@ class HtmlPage (Page):
                  stream.write((
                      '<tr>\n'
                      '  <td>{date}</td>\n'
-                    '  <td>{message-id-term}</td>\n'
+                    '  <td><code>{message-id-term}</code></td>\n'
                      '</tr>\n'
                      '<tr>\n'
                      '  <td>{from}</td>\n'
@@ -222,11 +227,14 @@ class HtmlPage (Page):
          if 'subject' in display_data and 'message-id' in display_data:
              d = {
                  'message-id': quote(display_data['message-id']),
-                'subject': display_data['subject'],
+                'subject': xml.sax.saxutils.escape(display_data['subject']),
                  }
              display_data['subject'] = (
                  '<a href="http://mid.gmane.org/{message-id}">{subject}</a>'
                  ).format(**d)
+        for key in ['message-id', 'from']:
+            if key in display_data:
+                display_data[key] = xml.sax.saxutils.escape(display_data[key])
          return (running_data, display_data)
  
      def _slug(self, string):
@@ -243,8 +251,10 @@ _PAGES['html'] = HtmlPage(
  </head>
  <body>
  <h2>Notmuch Patches</h2>
+<p>
  Generated: {date}<br />
  For more infomation see <a href="http://notmuchmail.org/nmbug">nmbug</a>
+</p>
  <h3>Views</h3>
  '''.format(date=datetime.datetime.utcnow().date()),
      footer='</body>\n</html>\n',