From c2cff25826e36982b8496e9c50a1c370d427ec81 Mon Sep 17 00:00:00 2001 From: Eric Rasche Date: Wed, 13 Apr 2016 00:38:25 +0000 Subject: [PATCH] Use CGI for escaping --- lib/galaxy/tools/errors.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/lib/galaxy/tools/errors.py b/lib/galaxy/tools/errors.py index 91a3ee8922a..09121680458 100644 --- a/lib/galaxy/tools/errors.py +++ b/lib/galaxy/tools/errors.py @@ -4,6 +4,7 @@ Functionality for dealing with tool errors. import string from galaxy import model, util, web from galaxy.util.sanitize_html import sanitize_html +import cgi error_report_template = """ GALAXY TOOL ERROR REPORT @@ -204,10 +205,8 @@ class ErrorReporter( object ): message=sanitize_html( util.unicodify( message ), 'utf-8', 'text/html' ) ) - self.report = string.Template( error_report_template ) \ - .safe_substitute( report_variables ) - self.html_report = string.Template( error_report_template_html ) \ - .safe_substitute( report_variables ) + self.report = string.Template( error_report_template ).safe_substitute( report_variables ) + self.html_report = cgi.escape( string.Template( error_report_template_html ).safe_substitute( report_variables ) ) def _send_report( self, user, email=None, message=None, **kwd ): return self.report