github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

Correctly escape output of ?_trace, refs #1360

Browse source
This commit is contained in:
Simon Willison 2021-06-05 14:49:16 -07:00
commit 8f311d6c1d
2 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
datasette/tracer.py
View file

@ -1,5 +1,6 @@
import asyncio
from contextlib import contextmanager
from markupsafe import escape
import time
import json
import traceback
@ -123,7 +124,7 @@ class AsgiTracer:
except IndexError:
content_type = ""
if "text/html" in content_type and b"</body>" in accumulated_body:
extra = json.dumps(trace_info, indent=2)
extra = escape(json.dumps(trace_info, indent=2))
extra_html = f"<pre>{extra}</pre></body>".encode("utf8")
accumulated_body = accumulated_body.replace(b"</body>", extra_html)
elif "json" in content_type and accumulated_body.startswith(b"{"):