Merge pull request #1414 from pulp/patchback/backports/3.12/52c60bc9a809521e462b8f5545b1e1b03910bd67/pr-1412

[PR #1412/52c60bc9 backport][3.12] [3.19] Autoescape data when rendering simple detail html

Author: jobselko

CHANGES/+simple_detail_html_xss.bugfix

@@ -0,0 +1 @@
+Fixed quoting mistake in simple html detail pages that can lead to a possible XSS attack.

pulp_python/app/utils.py

@@ -316,6 +316,6 @@ def write_simple_index(project_names, streamed=False):
 
 def write_simple_detail(project_name, project_packages, streamed=False):
     """Writes the simple detail page of a package."""
-    detail = Template(simple_detail_template)
+    detail = Template(simple_detail_template, autoescape=True)
     context = {"project_name": project_name, "project_packages": project_packages}
     return detail.stream(**context) if streamed else detail.render(**context)