Fix a few XSS-ish issues.

[pr0n] / perl / Sesse / pr0n / Common.pm

diff --git a/perl/Sesse/pr0n/Common.pm b/perl/Sesse/pr0n/Common.pm
index e12e8dc53efa85bba94a5a3221c37ab58025980f..073996f187bc06783d1dc8ac8c27019e6974d691 100644 (file)
--- a/perl/Sesse/pr0n/Common.pm
+++ b/perl/Sesse/pr0n/Common.pm
@@ -24,6 +24,7 @@ use LWP::Simple;
 # use Image::Info;
 use Image::ExifTool;
 use HTML::Entities;
+use URI::Escape;
 
 BEGIN {
        use Exporter ();
@@ -130,8 +131,11 @@ sub get_query_string {
                next unless defined($value);
                next if (defined($defparam->{$key}) && $value == $defparam->{$key});
 
-               # FIXME: We'll need to escape _ here somehow
-               $value =~ s/ /_/g;
+               $value = URI::Escape::uri_escape($value);
+
+               # Unescape a few for prettiness (we'll need something for a real _, though)
+               $value =~ s/%20/_/g;
+               $value =~ s/%2F/\//g;
        
                $str .= ($first) ? "?" : ';';
                $str .= "$key=$value";