[PATCH] view: escape HTML description name

[PATCH] view: escape HTML description name

[Eric Wong]

Otherwise funky filenames can cause HTML injection
vulnerabilities (hope you have JavaScript disabled!)
---
 lib/PublicInbox/View.pm | 1 +
 t/view.t                | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/PublicInbox/View.pm b/lib/PublicInbox/View.pm
index 0b1ec75..9ef4712 100644
--- a/lib/PublicInbox/View.pm
+++ b/lib/PublicInbox/View.pm
@@ -438,6 +438,7 @@ sub attach_link ($$$$;$) {
 	}
 	$ret .= "[-- Attachment #$idx: ";
 	my $ts = "Type: $ct, Size: $size bytes";
+	$desc = ascii_html($desc);
 	$ret .= ($desc eq '') ? "$ts --]" : "$desc --]\n[-- $ts --]";
 	$ret .= "</a>\n";
 }
diff --git a/t/view.t b/t/view.t
index 46fbe41..2181b5e 100644
--- a/t/view.t
+++ b/t/view.t
@@ -124,7 +124,7 @@ EOF
 		Email::MIME->create(
 			attributes => {
 				content_type => 'text/plain',
-				filename => "foo.patch",
+				filename => "foo&.patch",
 			},
 			body => "--- a/file\n+++ b/file\n" .
 			        "@@ -49, 7 +49,34 @@\n",
@@ -140,7 +140,7 @@ EOF
 	);
 
 	my $html = msg_html($mime);
-	like($html, qr!.*Attachment #2: foo\.patch --!,
+	like($html, qr!.*Attachment #2: foo&(?:amp|#38);\.patch --!,
 		"parts split with filename");
 }
 
-- 
EW