[Sks-devel] Bug: membership file too raw in stats page

[Phil Pennock]

I've not got time right now to get back into picking my way through
o'caml and the sks code, so I'll just report the issue in the hopes that
someone like Kim comes up with a fix.  :)

One of my peers had a line in their membership file which followed the
common idiom of:
  host.example.net 11370    # Fred Bloggs <address@hidden>

Unfortunately, they'd missed the '#' character.  The
/pks/lookup?op=stats page returned this raw with no HTML entity
escaping.

I noticed while debugging a fix for my sks-peers.py WSGI app (one of the
dependencies is going through API changes and I'd missed one), since
this meant that the Python BeautifulSoup HTML parser failed to parse the
page.

The stats renderer should be HTML-escaping the data it's putting into
fields in HTML.  And hey, if it's not already doing so, complaining more
loudly about such lines at parse time so the admins notice.  :)

Regards,
-Phil

pgpQZ2tTmfNcp.pgp
Description: PGP signature