diff options
| author | Ivan Kanakarakis <ivan.kanak@gmail.com> | 2019-05-14 15:32:30 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-05-14 15:32:30 +0200 |
| commit | 295d9a83b56d6c751c7cd7c03d1eba484de3339c (patch) | |
| tree | 62da4085f8812baf21f4731b01bf9c56ed4d1c8c | |
| parent | 7ba4338d012d7be87c3041ed7e87833f575cd932 (diff) | |
| parent | e86a489c353ee3e5e48712f4b85a5e4c4656a0e3 (diff) | |
| download | pysaml2-295d9a83b56d6c751c7cd7c03d1eba484de3339c.tar.gz | |
Merge pull request #610 from peppelinux/deprecation_warnings
Use html.escape when available
| -rw-r--r-- | src/saml2/pack.py | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/src/saml2/pack.py b/src/saml2/pack.py index b447be31..5a2534c2 100644 --- a/src/saml2/pack.py +++ b/src/saml2/pack.py @@ -8,7 +8,11 @@ Bindings normally consists of three parts: """ import base64 -import cgi +try: + import html +except: + import cgi as html + import logging import saml2 @@ -64,6 +68,10 @@ HTML_FORM_SPEC = """<!DOCTYPE html> </html>""" +def _html_escape(payload): + return html.escape(payload, quote=True) + + def http_form_post_message(message, location, relay_state="", typ="SAMLRequest", **kwargs): """The HTTP POST binding defines a mechanism by which SAML protocol @@ -87,15 +95,15 @@ def http_form_post_message(message, location, relay_state="", _msg = _msg.decode('ascii') saml_response_input = HTML_INPUT_ELEMENT_SPEC.format( - name=cgi.escape(typ), - val=cgi.escape(_msg), + name=_html_escape(typ), + val=_html_escape(_msg), type='hidden') relay_state_input = "" if relay_state: relay_state_input = HTML_INPUT_ELEMENT_SPEC.format( name='RelayState', - val=cgi.escape(relay_state), + val=_html_escape(relay_state), type='hidden') response = HTML_FORM_SPEC.format( |