Manual quoting/escaping is scattered ad hoc throughout the web code #3609

New Issue

exarkun · 2021-02-10T16:31:23Z

exarkun commented

2021-02-10 16:31:23 +00:00

Consider https://github.com/tahoe-lafs/tahoe-lafs/blob/master/src/allmydata/web/check_results.py#L435

It is a testament to someone's diligence that the name is being quoted using html.escape here. However, relying on diligence for every such occurrence is an unreliable strategy for producing correct, safe html output.

These cases should be handled automatically, systematically, and probably centrally in some part of the html generation library (twisted.web.template or our layer on top of it).

Consider <https://github.com/tahoe-lafs/tahoe-lafs/blob/master/src/allmydata/web/check_results.py#L435> It is a testament to someone's diligence that the name is being quoted using `html.escape` here. However, relying on diligence for every such occurrence is an unreliable strategy for producing correct, *safe* html output. These cases should be handled automatically, systematically, and probably centrally in some part of the html generation library (twisted.web.template or our layer on top of it).