Merge pull request #1404 from mdellweg/xss_injection

Validate and autoescape data when rendering html

(cherry picked from commit 2dc2355)

Author: jobselko

CHANGES/+simple_html_xss.bugfix

@@ -0,0 +1 @@
+Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871

pulp_python/app/utils.py

@@ -542,7 +542,7 @@ def find_artifact():
 
 def write_simple_index(project_names, streamed=False):
     """Writes the simple index."""
-    simple = Template(simple_index_template)
+    simple = Template(simple_index_template, autoescape=True)
     context = {
         "SIMPLE_API_VERSION": SIMPLE_API_VERSION,
         "projects": ((x, canonicalize_name(x)) for x in project_names),