fix XSS in debugger

Fix #1001
pallets · Aug 31, 2016 · 1034edc · 1034edc
1 parent be3033c
commit 1034edc
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGES b/CHANGES
@@ -13,6 +13,7 @@ Bugfix release, unreleased.
   see issue ``#995``.
 - Fix a bug in multidicts when passing empty lists as values, see issue
   ``#979``.
+- Fix a security issue that allows XSS on the Werkzeug debugger. See ``#1001``.
 
 Version 0.11.10
 ---------------

diff --git a/werkzeug/debug/tbtools.py b/werkzeug/debug/tbtools.py
@@ -358,7 +358,7 @@ def render_full(self, evalex=False, secret=None,
             'exception':        exc,
             'exception_type':   escape(self.exception_type),
             'summary':          self.render_summary(include_title=False),
-            'plaintext':        self.plaintext,
+            'plaintext':        escape(self.plaintext),
             'plaintext_cs':     re.sub('-{2,}', '-', self.plaintext),
             'traceback_id':     self.id,
             'secret':           secret