Merge pull request #1406 from pulp/patchback/backports/3.36/2dc23555c2f2d71f5fc2e370c26653abd5fb8eca/pr-1404

[PR #1404/2dc23555 backport][3.36] Validate and autoescape data when rendering html

Author: jobselko

CHANGES/+simple_html_xss.bugfix

@@ -0,0 +1 @@
+Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871

pulp_python/app/utils.py

@@ -556,7 +556,7 @@ def find_artifact():
 
 def write_simple_index(project_names):
     """Writes the simple index."""
-    simple = Template(simple_index_template)
+    simple = Template(simple_index_template, autoescape=True)
     context = {
         "SIMPLE_API_VERSION": SIMPLE_API_VERSION,
         "projects": ((x, canonicalize_name(x)) for x in project_names),