From af983cddcfa22c9e11a91b0d9b0f91444bfe91b5 Mon Sep 17 00:00:00 2001 From: Jitka Halova Date: Thu, 8 Oct 2026 21:50:21 +0200 Subject: [PATCH] Autoescape data when rendering simple detail html --- CHANGES/+simple_detail_html_xss.bugfix | 1 + pulp_python/app/utils.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 CHANGES/+simple_detail_html_xss.bugfix diff --git a/CHANGES/+simple_detail_html_xss.bugfix b/CHANGES/+simple_detail_html_xss.bugfix new file mode 100644 index 00000000..5b66585c --- /dev/null +++ b/CHANGES/+simple_detail_html_xss.bugfix @@ -0,0 +1 @@ +Fixed quoting mistake in simple html detail pages that can lead to a possible XSS attack. diff --git a/pulp_python/app/utils.py b/pulp_python/app/utils.py index 5101d207..f67b9f8a 100644 --- a/pulp_python/app/utils.py +++ b/pulp_python/app/utils.py @@ -411,7 +411,7 @@ def write_simple_index(project_names, streamed=False): def write_simple_detail(project_name, project_packages, streamed=False): """Writes the simple detail page of a package.""" - detail = Template(simple_detail_template) + detail = Template(simple_detail_template, autoescape=True) context = {"project_name": project_name, "project_packages": project_packages} return detail.stream(**context) if streamed else detail.render(**context)