Escape untrusted content before displaying it.
Reviewed in https://codereview.appspot.com/6460120/.
diff --git a/oauth2client/appengine.py b/oauth2client/appengine.py
index e9cb17e..5439a35 100644
--- a/oauth2client/appengine.py
+++ b/oauth2client/appengine.py
@@ -20,6 +20,7 @@
__author__ = 'jcgregorio@google.com (Joe Gregorio)'
import base64
+import cgi
import httplib2
import logging
import os
@@ -51,6 +52,18 @@
XSRF_MEMCACHE_ID = 'xsrf_secret_key'
+def _safe_html(s):
+ """Escape text to make it safe to display.
+
+ Args:
+ s: string, The text to escape.
+
+ Returns:
+ The escaped text as a string.
+ """
+ return cgi.escape(s, quote=1).replace("'", ''')
+
+
class InvalidClientSecretsError(Exception):
"""The client_secrets.json file is malformed or missing required fields."""
@@ -417,7 +430,7 @@
def _display_error_message(self, request_handler):
request_handler.response.out.write('<html><body>')
- request_handler.response.out.write(self._message)
+ request_handler.response.out.write(_safe_html(self._message))
request_handler.response.out.write('</body></html>')
def oauth_required(self, method):
@@ -578,7 +591,7 @@
if error:
errormsg = self.request.get('error_description', error)
self.response.out.write(
- 'The authorization request failed: %s' % errormsg)
+ 'The authorization request failed: %s' % _safe_html(errormsg))
else:
user = users.get_current_user()
decorator._create_flow(self)