[epiphany/mcatanzaro/#1612: 3/13] about-handler: properly encode page title/URL in about:overview

[Marge Bot <marge-bot src gnome org>]

commit 21b44d9b9fab1608a56a532cc98ee7c44d06de3d
Author: Michael Catanzaro <mcatanzaro redhat com>
Date:   Tue Dec 14 16:43:05 2021 -0600

    about-handler: properly encode page title/URL in about:overview
    
    Otherwise, web pages can execute code in about:overview via a malicious
    page title. It might be possible to do the same via the URL, so better
    encode that too.
    
    Fixes #1612
    
    Part-of: <https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045>

 embed/ephy-about-handler.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)
---
diff --git a/embed/ephy-about-handler.c b/embed/ephy-about-handler.c
index 4c794f526..aecb50731 100644
--- a/embed/ephy-about-handler.c
+++ b/embed/ephy-about-handler.c
@@ -27,6 +27,7 @@
 #include "ephy-file-helpers.h"
 #include "ephy-flatpak-utils.h"
 #include "ephy-history-service.h"
+#include "ephy-output-encoding.h"
 #include "ephy-prefs.h"
 #include "ephy-settings.h"
 #include "ephy-smaps.h"
@@ -410,7 +411,8 @@ history_service_query_urls_cb (EphyHistoryService     *history,
     EphyHistoryURL *url = (EphyHistoryURL *)l->data;
     const char *snapshot;
     g_autofree char *thumbnail_style = NULL;
-    g_autofree char *markup = NULL;
+    g_autofree char *encoded_title = NULL;
+    g_autofree char *encoded_url = NULL;
 
     snapshot = ephy_snapshot_service_lookup_cached_snapshot_path (snapshot_service, url->url);
     if (snapshot)
@@ -418,15 +420,17 @@ history_service_query_urls_cb (EphyHistoryService     *history,
     else
       ephy_embed_shell_schedule_thumbnail_update (shell, url);
 
-    markup = g_markup_escape_text (url->title, -1);
+    /* Title and URL are controlled by web content and could be malicious. */
+    encoded_title = ephy_encode_for_html_attribute (url->title);
+    encoded_url = ephy_encode_for_html_attribute (url->url);
     g_string_append_printf (data_str,
                             "<a class=\"overview-item\" title=\"%s\" href=\"%s\">"
                             "  <div class=\"overview-close-button\" title=\"%s\"></div>"
                             "  <span class=\"overview-thumbnail\"%s></span>"
                             "  <span class=\"overview-title\">%s</span>"
                             "</a>",
-                            markup, url->url, _("Remove from overview"),
-                            thumbnail_style ? thumbnail_style : "", url->title);
+                            encoded_title, encoded_url, _("Remove from overview"),
+                            thumbnail_style ? thumbnail_style : "", encoded_title);
   }
 
   data_str = g_string_append (data_str,