Bug#319187: /usr/bin/bon_csv2html: bon_csv2html doesnt escape value of name field in html and regexes

[Arthur Korn]

Package: bonnie++
Version: 1.03a
Severity: minor
File: /usr/bin/bon_csv2html
Tags: patch

With names like twoflower->turing(nfs:size=4096) I got illegal html that
rendered to illegible tables in mozilla. A quick and dirty fix is
attached. Additionally, using characters that are special in perl
regexes in the name would break the script too, I inserted \Q\E at the
appropriate places (might have missed some).

HTH, 2ri

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/dash
Kernel: Linux 2.6.11-1-686-smp
Locale: LANG=de_CH.UTF-8, LC_CTYPE=de_CH.UTF-8 (charmap=UTF-8)

Versions of packages bonnie++ depends on:
ii  libc6                       2.3.2.ds1-22 GNU C Library: Shared libraries an
ii  libgcc1                     1:4.0.1-2    GCC support library
ii  libstdc++5                  1:3.3.6-7    The GNU Standard C++ Library v3

bonnie++ recommends no packages.

-- no debconf information

--- /usr/bin/bon_csv2html       2003-01-10 15:21:47.000000000 +0100
+++ bin/bon_csv2html    2005-07-20 14:05:59.527635698 +0200
@@ -87,15 +87,23 @@
   chop($line);
   my $name = $line;
   $name =~ s/,.*$//;
-  $line =~ s/$name,//;
+  $line =~ s/\Q$name\E,//;
   my $size = $line;
   $size =~ s/,.*$//;
-  $line =~ s/$size,//;
+  $line =~ s/\Q$size\E,//;
   print '<TR><TD class="rowheader"><FONT SIZE=+1><B>'
-         . $name . "</B></FONT></TD>";
-  print '<TD class="size">' . $size . "</TD>";
+         . s2ht($name) . "</B></FONT></TD>";
+  print '<TD class="size">' . s2ht($size) . "</TD>";
 
 
   $line =~ s/,/<\/TD><TD>/g;
   print "<TD>" . $line . "</TD></TR>\n";
 }
+
+sub s2ht
+{      # only cares about < >
+    $_=shift;
+    s/</&lt;/g;
+    s/>/&gt;/g;
+    return $_;
+}