diff options
| author | Eric Wong <e@80x24.org> | 2016-06-07 07:14:01 +0000 |
|---|---|---|
| committer | Eric Wong <e@80x24.org> | 2016-06-07 07:14:37 +0000 |
| commit | 115f78accd1cd79ea716db1d4e29ddc0633a9d45 (patch) | |
| tree | c3386a91a6996c6d2da9f92f2e1a86146ca7dfd8 /lib/PublicInbox | |
| parent | 1365e185d817cdc2de04968c37f597d92226a13b (diff) | |
| download | public-inbox-115f78accd1cd79ea716db1d4e29ddc0633a9d45.tar.gz | |
Oops :x Add an additional test for live data for any unprintable characters, too, since this could be a dangerous source of HTML injection.
Diffstat (limited to 'lib/PublicInbox')
| -rw-r--r-- | lib/PublicInbox/View.pm | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/PublicInbox/View.pm b/lib/PublicInbox/View.pm index 2b40bcdd..0ba78fe2 100644 --- a/lib/PublicInbox/View.pm +++ b/lib/PublicInbox/View.pm @@ -324,7 +324,8 @@ sub headers_to_html_header { $v = PublicInbox::Hval->new($v); if ($h eq 'From') { - $title[1] = PublicInbox::Address::from_name($v->raw); + my $n = PublicInbox::Address::from_name($v->raw); + $title[1] = ascii_html($n); } elsif ($h eq 'Subject') { $title[0] = $v->as_html; if ($srch) { |