Bug 11265 – Slim/Utils/MemoryUsage -- incomplete logic for escape_html()

Bug 11265 - Slim/Utils/MemoryUsage -- incomplete logic for escape_html()

Summary:

Slim/Utils/MemoryUsage -- incomplete logic for escape_html()

Status:	NEW

Product:	Logitech Media Server
Classification:	Unclassified
Component:	Misc
Version:	7.4.0
Platform:	PC Other

Importance:	-- trivial (vote)
Target Milestone:	8.0.0
Assigned To:	Andy Grundman

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2009-03-05 20:00 UTC by Peter Watkins
Modified:	2009-07-29 14:59 UTC (History)
CC List:	1 user (show)

See Also:
Category:	---

Attachments
patch to add escaping of quote and apostrophe (371 bytes, patch) 2009-03-05 20:00 UTC, Peter Watkins	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Peter Watkins 2009-03-05 20:00:11 UTC

Created attachment 4889 [details]
patch to add escaping of quote and apostrophe

If only there were a contest for the most pedantic bug report, this would surely be in the running...

I just modified some of my plugins to no longer rely on CGI.pm. Looking for alternative providers of the few methods I needed, I discovered that Slim::Utils::MemoryUsage::escape_html escapes only <, >, and & characters. It probably ought to also escape " and ' characters. It appears that only MemoryUsage.pm relies on this routine, and its incompleteness appears to be harmless, so long as nobody else grabs that code and uses it in a place where they need it to prevent text from breaking out of quotation marks, as when embedding text in the attribute of an HTML element.

Comment 1 Spies Steven 2009-03-06 10:51:39 UTC

Andy, does this seem like a safe change to you?

Comment 2 Andy Grundman 2009-03-06 11:03:46 UTC

Sure.

Comment 3 Chris Owens 2009-03-16 09:51:57 UTC

We are now planning to make a 7.3.3 release.  Please review your bugs (all marked open against 7.3.3) to see if they can be fixed in the next few weeks, or if they should be retargeted for 7.4 or future.

Thanks!

Comment 4 Chris Owens 2009-03-30 17:32:39 UTC

Since there's now a planned 7.3.3 release, bugs which won't make the cut-off are being moved to the next target out.  If you feel that this bug needs to be addressed more (or less) urgently than the 7.4 release, please cc chris@slimdevices.com and leave a comment in the bug to that effect so we can review it.

Thanks.

Comment 5 Chris Owens 2009-03-31 08:55:09 UTC

For some reason Bugzilla did not change the target when I did this yesterday.  Or maybe it was me.  In either case, I'm trying it again.

Comment 6 Andy Grundman 2009-07-29 14:59:01 UTC

Moving 7.4 bugs to 8.0.