Skip to content

Commit 830ddc7

Browse files
Revert "bpo-35603: Escape table header of make_table output that can cause potential XSS. (GH-11341)" (GH-11356)
This reverts commit 78de011.
1 parent 3a374e0 commit 830ddc7

File tree

3 files changed

+0
-15
lines changed

3 files changed

+0
-15
lines changed

Lib/difflib.py

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2036,10 +2036,6 @@ def make_table(self,fromlines,tolines,fromdesc='',todesc='',context=False,
20362036
s.append( fmt % (next_id[i],next_href[i],fromlist[i],
20372037
next_href[i],tolist[i]))
20382038
if fromdesc or todesc:
2039-
fromdesc = fromdesc.replace("&", "&").replace(">", ">") \
2040-
.replace("<", "&lt;")
2041-
todesc = todesc.replace("&", "&amp;").replace(">", "&gt;") \
2042-
.replace("<", "&lt;")
20432039
header_row = '<thead><tr>%s%s%s%s</tr></thead>' % (
20442040
'<th class="diff_next"><br /></th>',
20452041
'<th colspan="2" class="diff_header">%s</th>' % fromdesc,

Lib/test/test_difflib.py

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -238,15 +238,6 @@ def test_html_diff(self):
238238
with open(findfile('test_difflib_expect.html')) as fp:
239239
self.assertEqual(actual, fp.read())
240240

241-
def test_make_table_escape_table_header(self):
242-
html_diff = difflib.HtmlDiff()
243-
output = html_diff.make_table(patch914575_from1.splitlines(),
244-
patch914575_to1.splitlines(),
245-
fromdesc='<from>',
246-
todesc='<to>')
247-
self.assertIn('&lt;from&gt;', output)
248-
self.assertIn('&lt;to&gt;', output)
249-
250241
def test_recursion_limit(self):
251242
# Check if the problem described in patch #1413711 exists.
252243
limit = sys.getrecursionlimit()

Misc/NEWS.d/next/Library/2018-12-28-14-53-22.bpo-35603.rVCZAE.rst

Lines changed: 0 additions & 2 deletions
This file was deleted.

0 commit comments

Comments
 (0)