Merge pull request #3172 from stevepiercy/1.9-branch

Steve Piercy

2017-09-23 1d16ab4802e1f398d26901ff5f7c1bc1118c09e4

Merge pull request #3172 from stevepiercy/1.9-branch

use pyramid.compat.escape instead of cgi.escape

 docs/quick_tour/views/views.py

@@ -1,4 +1,4 @@
import cgi
from pyramid.compat import escape

from pyramid.httpexceptions import HTTPFound
from pyramid.response import Response
@@ -16,8 +16,8 @@
def hello_view(request):
    name = request.params.get('name', 'No Name')
    body = '<p>Hi %s, this <a href="/goto">redirects</a></p>'
    # cgi.escape to prevent Cross-Site Scripting (XSS) [CWE 79]
    return Response(body % cgi.escape(name))
    # pyramid.compat.escape to prevent Cross-Site Scripting (XSS) [CWE 79]
    return Response(body % escape(name))


# /goto which issues HTTP redirect to the last view