avoid injection in input prompt

12 years ago · f5fa732bd3
parent da001113fa
commit f5fa732bd3
1 changed files with 6 additions and 1 deletions
--- a/IPython/html/static/notebook/js/codecell.js
+++ b/IPython/html/static/notebook/js/codecell.js
@ -409,7 +409,12 @@ var IPython = (function (IPython) {


    CodeCell.input_prompt_classical = function (prompt_value, lines_number) {
-        var ns = prompt_value || "&nbsp;";
+        var ns;
+        if (prompt_value == undefined) {
+            ns = "&nbsp;";
+        } else {
+            ns = encodeURIComponent(prompt_value);
+        }
        return 'In&nbsp;[' + ns + ']:';
    };