| Subject: | PATCH: Param names not escaped properly in Dump, allowing raw HTML through |
escapeHTML was not being used on parameter names in Dump. The below
patch fixes it.
( escapeHTML was being called, but the escaped value was being ignored!)
Mark
--- CGI.pm 2006-09-06 03:46:17.000000000 +0200
+++ CGI.pm.new 2006-09-06 03:44:51.000000000 +0200
@@ -1259,8 +1259,7 @@
push(@result,"<ul>");
foreach $param ($self->param) {
my($name)=$self->escapeHTML($param);
- push(@result,"<li><strong>$param</strong></li>");
+ push(@result,"<li><strong>$name</strong></li>");
push(@result,"<ul>");
foreach $value ($self->param($param)) {
$value = $self->escapeHTML($value);