Fix XSS issues in http_server's dir-listing and error-page.

Fix XSS issues in http_server's dir-listing and error-page.

BUG=
R=sgjesse@google.com

Committed: https://code.google.com/p/dart/source/detail?r=34769

[Søren Gjesse, 2014-04-04 12:54:26]

lgtm

https://codereview.chromium.org/225813002/diff/1/pkg/http_server/lib/src/virt...
File pkg/http_server/lib/src/virtual_directory.dart (right):

https://codereview.chromium.org/225813002/diff/1/pkg/http_server/lib/src/virt...
pkg/http_server/lib/src/virtual_directory.dart:288: try {
Indentation.

https://codereview.chromium.org/225813002/diff/1/pkg/http_server/lib/src/virt...
pkg/http_server/lib/src/virtual_directory.dart:303: print(e);
Debug print? What do do here?

[Anders Johnsen, 2014-04-04 12:58:13]

Will wait for Nathan to comment.

https://codereview.chromium.org/225813002/diff/1/pkg/http_server/lib/src/virt...
File pkg/http_server/lib/src/virtual_directory.dart (right):

https://codereview.chromium.org/225813002/diff/1/pkg/http_server/lib/src/virt...
pkg/http_server/lib/src/virtual_directory.dart:288: try {
On 2014/04/04 12:54:26, Søren Gjesse wrote:
> Indentation.

Oops, debug try catch.

https://codereview.chromium.org/225813002/diff/1/pkg/http_server/lib/src/virt...
pkg/http_server/lib/src/virtual_directory.dart:303: print(e);
On 2014/04/04 12:54:26, Søren Gjesse wrote:
> Debug print? What do do here?

Done.

[nweiz, 2014-04-04 18:06:37]

https://codereview.chromium.org/225813002/diff/20001/pkg/http_server/lib/src/...
File pkg/http_server/lib/src/virtual_directory.dart (right):

https://codereview.chromium.org/225813002/diff/20001/pkg/http_server/lib/src/...
pkg/http_server/lib/src/virtual_directory.dart:297: <td>$modified</td>
Escape [modified] as well. Even though it doesn't come from user input, it's
good practice to escape all your strings that aren't explicitly intended to
contain HTML.

https://codereview.chromium.org/225813002/diff/20001/pkg/http_server/lib/src/...
pkg/http_server/lib/src/virtual_directory.dart:352: <h1>Error $error at
\'$encodedPath\': $reason</h1>
Escape [error] and [reason].

https://codereview.chromium.org/225813002/diff/20001/pkg/http_server/test/vir...
File pkg/http_server/test/virtual_directory_test.dart (right):

https://codereview.chromium.org/225813002/diff/20001/pkg/http_server/test/vir...
pkg/http_server/test/virtual_directory_test.dart:134: new
Directory('${dir.path}/alert(\'hacked!\');').createSync();
"/" isn't a great test case for HTML-escaping because it's not an HTML-active
character. Make sure you test "<", ">", and "&".

[Anders Johnsen, 2014-04-07 07:03:08]

Thanks. Landing.

https://codereview.chromium.org/225813002/diff/20001/pkg/http_server/lib/src/...
File pkg/http_server/lib/src/virtual_directory.dart (right):

https://codereview.chromium.org/225813002/diff/20001/pkg/http_server/lib/src/...
pkg/http_server/lib/src/virtual_directory.dart:297: <td>$modified</td>
On 2014/04/04 18:06:37, nweiz wrote:
> Escape [modified] as well. Even though it doesn't come from user input, it's
> good practice to escape all your strings that aren't explicitly intended to
> contain HTML.

Done.

https://codereview.chromium.org/225813002/diff/20001/pkg/http_server/lib/src/...
pkg/http_server/lib/src/virtual_directory.dart:352: <h1>Error $error at
\'$encodedPath\': $reason</h1>
On 2014/04/04 18:06:37, nweiz wrote:
> Escape [error] and [reason].

Done.

https://codereview.chromium.org/225813002/diff/20001/pkg/http_server/test/vir...
File pkg/http_server/test/virtual_directory_test.dart (right):

https://codereview.chromium.org/225813002/diff/20001/pkg/http_server/test/vir...
pkg/http_server/test/virtual_directory_test.dart:134: new
Directory('${dir.path}/alert(\'hacked!\');').createSync();
On 2014/04/04 18:06:37, nweiz wrote:
> "/" isn't a great test case for HTML-escaping because it's not an HTML-active
> character. Make sure you test "<", ">", and "&".

Done.

[Anders Johnsen, 2014-04-07 07:03:31]

Committed patchset #3 manually as r34769 (presubmit successful).