From 10ce9fad8bc36fd23f0d3c0dc26f267748e3a4a6 Mon Sep 17 00:00:00 2001
From: "Peter J. Holzer" <hjp@hjp.at>
Date: Wed, 15 Apr 2020 21:39:56 +0200
Subject: [PATCH] Escape from and subject

---
 mbox2web | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/mbox2web b/mbox2web
index f1ffe26..f238dc8 100755
--- a/mbox2web
+++ b/mbox2web
@@ -927,8 +927,8 @@ class Message:
             in_reply_to_msgid = [references_msgids[-1]]
         self.in_reply_to = in_reply_to_msgids
         self.references = references_msgids
-        self.mfrom = msg["From"]
-        self.subject = msg["Subject"]
+        self.mfrom = decode_rfc2047(msg["From"])
+        self.subject = decode_rfc2047(msg["Subject"])
         self.msg = msg
         self.kids = False
         if self.date.tzinfo is None:
@@ -1125,15 +1125,15 @@ class Thread:
         
         # XXX  - escape!
         s += f"<td class='date'><a href='/msg/{lines[0][3]}/'>{lines[0][0]}</a></td>"
-        s += f"<td class='from'>{lines[0][1]}</td>"
-        s += f"<td class='subject'>{lines[0][2]}</td>"
+        s += f"<td class='from'>{html.escape(lines[0][1])}</td>"
+        s += f"<td class='subject'>{html.escape(lines[0][2])}</td>"
         s += "</tr>"
 
         for ln in lines[1:]:
             s += "<tr>"
             s += f"<td class='date'><a href='/msg/{ln[3]}/'>{ln[0]}</a></td>"
-            s += f"<td class='from'>{ln[1]}</td>"
-            s += f"<td class='subject'>{ln[2]}</td>"
+            s += f"<td class='from'>{html.escape(ln[1])}</td>"
+            s += f"<td class='subject'>{html.escape(ln[2])}</td>"
             s += "</tr>"
         s += "</table>"
         self._as_html = s