From 115f78accd1cd79ea716db1d4e29ddc0633a9d45 Mon Sep 17 00:00:00 2001
From: Eric Wong <e@80x24.org>
Date: Tue, 7 Jun 2016 07:14:01 +0000
Subject: view: escape From name properly for title

Oops :x   Add an additional test for live data for any
unprintable characters, too, since this could be a dangerous
source of HTML injection.
---
 t/check-www-inbox.perl | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 't')

diff --git a/t/check-www-inbox.perl b/t/check-www-inbox.perl
index 7cfe1932..6be631e9 100644
--- a/t/check-www-inbox.perl
+++ b/t/check-www-inbox.perl
@@ -13,6 +13,7 @@ use LWP::ConnCache;
 use POSIX qw(:sys_wait_h);
 use Time::HiRes qw(gettimeofday tv_interval);
 use WWW::Mechanize;
+use Data::Dumper;
 my $nproc = 4;
 my $slow = 0.5;
 my %opts = (
@@ -145,5 +146,16 @@ sub worker_loop {
 			my $n = length($l);
 			die "$$ send truncated $s < $n\n" if $s != $n;
 		}
+
+		# make sure the HTML source doesn't screw up terminals
+		# when people curl the source (not remotely an expert
+		# on languages or encodings, here).
+		next if $r->header('Content-Type') !~ m!\btext/html\b!;
+		my $dc = $r->decoded_content;
+		if ($dc =~ /([\x00-\x08\x0d-\x1f\x7f-\x{99999999}]+)/s) {
+			my $o = $1;
+			my $c = Dumper($o);
+			warn "bad: $u $c\n";
+		}
 	}
 }
-- 
cgit v1.2.3-24-ge0c7