From eee948067819618be58575249ded2436d5a42ace Mon Sep 17 00:00:00 2001
From: "justdave%syndicomm.com"
 <justdave%syndicomm.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 11 May 2001 18:02:38 +0000
Subject: [PATCH] Fix for bug 38859: escape invalid email addresses for HTML
 before displaying to the user. Patch by Myk Melez <myk@mozilla.org> r=
 jake@acutex.net, justdave@syndicomm.com

git-svn-id: svn://10.0.0.236/trunk@94669 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/CGI.pl | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mozilla/webtools/bugzilla/CGI.pl b/mozilla/webtools/bugzilla/CGI.pl
index 587ecc07473..e82ce891148 100644
--- a/mozilla/webtools/bugzilla/CGI.pl
+++ b/mozilla/webtools/bugzilla/CGI.pl
@@ -593,6 +593,9 @@ sub CheckEmailSyntax {
     if ($addr !~ /$match/) {
         print "Content-type: text/html\n\n";
 
+        # For security, escape HTML special characters.
+        $addr = html_quote($addr);
+
         PutHeader("Check e-mail syntax");
         print "The e-mail address you entered\n";
         print "(<b>$addr</b>) didn't match our minimal\n";