@@ -1,5 +1,6 @@

from xmlrpc.server import DocXMLRPCServer

import http.client

import re

import sys

from test import support

threading = support.import_module('threading')

@@ -193,6 +194,21 @@ def test_annotations(self):

b'method_annotation</strong></a>(x: bytes)</dt></dl>'),

response.read())

def test_server_title_escape(self):

# bpo-38243: Ensure that the server title and documentation

# are escaped for HTML.

self.serv.set_server_title('test_title<script>')

self.serv.set_server_documentation('test_documentation<script>')

self.assertEqual('test_title<script>', self.serv.server_title)

self.assertEqual('test_documentation<script>',

self.serv.server_documentation)

generated = self.serv.generate_html_documentation()

title = re.search(r'<title>(.+?)</title>', generated).group()

documentation = re.search(r'<p><tt>(.+?)</tt></p>', generated).group()

self.assertEqual('<title>Python: test_title&lt;script&gt;</title>', title)

self.assertEqual('<p><tt>test_documentation&lt;script&gt;</tt></p>', documentation)

if __name__ == '__main__':

unittest.main()

@@ -106,6 +106,7 @@ def export_add(self, x, y):

from xmlrpc.client import Fault, dumps, loads, gzip_encode, gzip_decode

from http.server import BaseHTTPRequestHandler

import html

import http.server

import socketserver

import sys

@@ -904,7 +905,7 @@ def generate_html_documentation(self):

methods

)

return documenter.page(self.server_title, documentation)

return documenter.page(html.escape(self.server_title), documentation)

class DocXMLRPCRequestHandler(SimpleXMLRPCRequestHandler):

"""XML-RPC and documentation request handler class.

@@ -0,0 +1,3 @@

Escape the server title of :class:`xmlrpc.server.DocXMLRPCServer`

when rendering the document page as HTML.

(Contributed by Dong-hee Na in :issue:`38243`.)