Fix a few XSS-ish issues.

[pr0n] / perl / Sesse / pr0n / Common.pm

diff --git a/perl/Sesse/pr0n/Common.pm b/perl/Sesse/pr0n/Common.pm
index 9b05d398c8583b20fab652435d1493cdca1e12d6..073996f187bc06783d1dc8ac8c27019e6974d691 100644 (file)
--- a/perl/Sesse/pr0n/Common.pm
+++ b/perl/Sesse/pr0n/Common.pm
@@ -24,6 +24,7 @@ use LWP::Simple;
 # use Image::Info;
 use Image::ExifTool;
 use HTML::Entities;
+use URI::Escape;
 
 BEGIN {
        use Exporter ();
@@ -129,6 +130,12 @@ sub get_query_string {
        while (my ($key, $value) = each %$param) {
                next unless defined($value);
                next if (defined($defparam->{$key}) && $value == $defparam->{$key});
+
+               $value = URI::Escape::uri_escape($value);
+
+               # Unescape a few for prettiness (we'll need something for a real _, though)
+               $value =~ s/%20/_/g;
+               $value =~ s/%2F/\//g;
        
                $str .= ($first) ? "?" : ';';
                $str .= "$key=$value";