From 0cd78b139de44c9018d623d2004d65184fff3275 Mon Sep 17 00:00:00 2001 From: Eric Wong Date: Sat, 27 Apr 2019 21:46:54 +0000 Subject: extmsg: escape ampersands in @EXT_URL array We already escape the user-provided Message-IDs (so there's no security problem AFAIK), but the URL templates which exist in our source code were not escaped properly. This quiets down tidy(1). --- lib/PublicInbox/ExtMsg.pm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/PublicInbox/ExtMsg.pm b/lib/PublicInbox/ExtMsg.pm index 14d49cc5..d07d5a79 100644 --- a/lib/PublicInbox/ExtMsg.pm +++ b/lib/PublicInbox/ExtMsg.pm @@ -8,13 +8,13 @@ package PublicInbox::ExtMsg; use strict; use warnings; -use PublicInbox::Hval; +use PublicInbox::Hval qw/ascii_html/; use PublicInbox::MID qw/mid2path/; use PublicInbox::WwwStream; our $MIN_PARTIAL_LEN = 16; # TODO: user-configurable -our @EXT_URL = ( +our @EXT_URL = map { ascii_html($_) } ( # leading "//" denotes protocol-relative (http:// or https://) '//marc.info/?i=%s', '//www.mail-archive.com/search?l=mid&q=%s', -- cgit v1.2.3-24-ge0c7