[tahoe-lafs-trac-stream] [tahoe-lafs] #1143: Double Encoding in HTML in File Names in WUI

[tahoe-lafs]

#1143: Double Encoding in HTML in File Names in WUI
-----------------------------------+---------------------------
     Reporter:  chrisp             |      Owner:  davidsarah
         Type:  defect             |     Status:  assigned
     Priority:  major              |  Milestone:  1.10.0
    Component:  code-frontend-web  |    Version:  1.7.1
   Resolution:                     |   Keywords:  easy wui html
Launchpad Bug:                     |
-----------------------------------+---------------------------

Comment (by zooko):

 Since Nevow's {{{escapeToXML}}} method leaves single/double quotes intact,
 could that be used to malicious craft input which would confuse the HTML
 parser by having embedded quote characters?

-- 
Ticket URL: <https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1143#comment:6>
tahoe-lafs <https://tahoe-lafs.org>
secure decentralized storage