user/dev discussion of public-inbox itself
 help / color / mirror / code / Atom feed
From: Eric Wong <e@80x24.org>
To: meta@public-inbox.org
Subject: [PATCH] view: escape From name properly for title
Date: Tue,  7 Jun 2016 07:14:01 +0000	[thread overview]
Message-ID: <20160607071401.29325-1-e@80x24.org> (raw)

Oops :x   Add an additional test for live data for any
unprintable characters, too, since this could be a dangerous
source of HTML injection.
---
 lib/PublicInbox/View.pm |  3 ++-
 t/check-www-inbox.perl  | 12 ++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/lib/PublicInbox/View.pm b/lib/PublicInbox/View.pm
index 46a581b..c03e1b5 100644
--- a/lib/PublicInbox/View.pm
+++ b/lib/PublicInbox/View.pm
@@ -322,7 +322,8 @@ sub headers_to_html_header {
 		$v = PublicInbox::Hval->new($v);
 
 		if ($h eq 'From') {
-			$title[1] = PublicInbox::Address::from_name($v->raw);
+			my $n = PublicInbox::Address::from_name($v->raw);
+			$title[1] = ascii_html($n);
 		} elsif ($h eq 'Subject') {
 			$title[0] = $v->as_html;
 			if ($srch) {
diff --git a/t/check-www-inbox.perl b/t/check-www-inbox.perl
index 7cfe193..6be631e 100644
--- a/t/check-www-inbox.perl
+++ b/t/check-www-inbox.perl
@@ -13,6 +13,7 @@ use LWP::ConnCache;
 use POSIX qw(:sys_wait_h);
 use Time::HiRes qw(gettimeofday tv_interval);
 use WWW::Mechanize;
+use Data::Dumper;
 my $nproc = 4;
 my $slow = 0.5;
 my %opts = (
@@ -145,5 +146,16 @@ sub worker_loop {
 			my $n = length($l);
 			die "$$ send truncated $s < $n\n" if $s != $n;
 		}
+
+		# make sure the HTML source doesn't screw up terminals
+		# when people curl the source (not remotely an expert
+		# on languages or encodings, here).
+		next if $r->header('Content-Type') !~ m!\btext/html\b!;
+		my $dc = $r->decoded_content;
+		if ($dc =~ /([\x00-\x08\x0d-\x1f\x7f-\x{99999999}]+)/s) {
+			my $o = $1;
+			my $c = Dumper($o);
+			warn "bad: $u $c\n";
+		}
 	}
 }

                 reply	other threads:[~2016-06-07  7:14 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://public-inbox.org/README

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160607071401.29325-1-e@80x24.org \
    --to=e@80x24.org \
    --cc=meta@public-inbox.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://80x24.org/public-inbox.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).