CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2014/07/22 16:41:29
Modified files:
usr.bin/mandoc : html.c
Log message:
Security fix:
The function print_encode() is used both for plain text
and for quoted attribute values.
Escape the '"' character such that malicious manuals cannot pull off
XSS attacks using malformed .Lk, .Mt, .%U, and .UR macros (and maybe
others) to trigger the latter case.
In the former case, escaping does no harm.
Issue found by Sebastien Marie <semarie-openbsd at latrappe dot fr>.
