Escape scripts in HTML output

powertop-1.98-html-escape.patch

@@ -0,0 +1,38 @@
+diff --git a/tuning/tuning.cpp b/tuning/tuning.cpp
+index dd5b1dc..234cea9 100644
+--- a/tuning/tuning.cpp
++++ b/tuning/tuning.cpp
+@@ -192,6 +192,21 @@ static const char *tune_class_bad(int line)
+ 	return "tunable_even_bad";
+ }
+ 
++static void html_encode(std::string& data) {
++	std::string buffer;
++	buffer.reserve(data.size());
++	for (size_t pos = 0; pos != data.size(); ++pos) {
++		switch(data[pos]) {
++			case '&':  buffer.append("&");       break;
++			case '\"': buffer.append(""");      break;
++			case '<':  buffer.append("&lt;");        break;
++			case '>':  buffer.append("&gt;");        break;
++			default:   buffer.append(1, data[pos]); break;
++		}
++	}
++	data.swap(buffer);
++}
++
+ 
+ void html_show_tunables(void)
+ {
+@@ -218,7 +233,10 @@ void html_show_tunables(void)
+ 		}
+ 
+ 		line++;
+-		fprintf(htmlout, "<tr class=\"%s\"><td>%s</td><td>%s</td></tr>\n", tune_class_bad(line), all_tunables[i]->description(), all_tunables[i]->toggle_script());
++
++		std::string script(all_tunables[i]->toggle_script());
++		html_encode(script);
++		fprintf(htmlout, "<tr class=\"%s\"><td>%s</td><td>%s</td></tr>\n", tune_class_bad(line), all_tunables[i]->description(), script.c_str());
+ 	}
+ 
+ 	if (line > 0) 

powertop.spec

@@ -1,6 +1,6 @@
 Name:          powertop
 Version:       1.98
-Release:       7%{?dist}
+Release:       8%{?dist}
 Summary:       Power consumption monitor
 
 Group:         Applications/System
@@ -22,6 +22,7 @@ Patch4:        powertop-1.98-power-supply-add-power-now-support.patch
 Patch5:        powertop-1.98-power-supply-units-fix.patch
 # Accepted upstream
 Patch6:        powertop-1.98-html-print-commands.patch
+Patch7:        powertop-1.98-html-escape.patch
 BuildRoot:     %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: gettext, ncurses-devel, pciutils-devel, zlib-devel, libnl-devel
 
@@ -38,6 +39,7 @@ computer use more power than necessary while it is idle.
 %patch4 -p1 -b .power-supply-add-power-now-support
 %patch5 -p1 -b .power-supply-units-fix
 %patch6 -p1 -b .html-print-commands
+%patch7 -p1 -b .html-escape
 
 %build
 make %{?_smp_mflags} CFLAGS="$RPM_OPT_FLAGS"
@@ -70,6 +72,9 @@ rm -rf %{buildroot}
 #%{_mandir}/man8/powertop.8*
 
 %changelog
+* Tue Apr 03 2012 Jan Kaluza <jkaluza@redhat.com> - 1.98-8
+- Escape scripts in HTML output
+
 * Mon Mar 26 2012 Jaroslav Škarvada <jskarvad@redhat.com> - 1.98-7
 - Print commands which reproduce the tunings into html log (html-print-commands patch)