From 0e5c8ae806283d31bcfaf63f5af361f97dbe91f0 Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Wed, 28 Feb 2018 09:40:45 +0000 Subject: preprocess: Escape most ASCII punctuation in error messages This is a minimal version of what we should in principle do here, which is to escape the error message in whatever way is correct for embedding plain text in the surrounding wiki markup language. This implementation approximates that by assuming that HTML entities, alphanumerics and common punctuation characters are passed through the markup language unaltered, but punctuation characters might be misinterpreted. Signed-off-by: Simon McVittie --- IkiWiki.pm | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'IkiWiki.pm') diff --git a/IkiWiki.pm b/IkiWiki.pm index 0d87242eb..7a38c8f89 100644 --- a/IkiWiki.pm +++ b/IkiWiki.pm @@ -1668,6 +1668,10 @@ sub preprocess ($$$;$$) { chomp $error; eval q{use HTML::Entities}; $error = encode_entities($error); + # Also encode most ASCII punctuation + # as entities so that error messages + # are not interpreted as Markdown etc. + $error = encode_entities($error, '[](){}!#$%*?@^`|~'."\\"); $ret="[[!$command ". gettext("Error").": $error"."]]"; } -- cgit v1.2.3