Merging in @ahmedsalhin's PR, jrjohansson#16

leebrian · Aug 16, 2021 · 8c5022a · 8c5022a
2 parents 6b08aa7 + 2df4197
commit 8c5022a
Showing 1 changed file with 27 additions and 9 deletions.
diff --git a/version_information/version_information.py b/version_information/version_information.py
@@ -47,7 +47,7 @@
    (the ``version`` field from ``setup.py``).
 
 """
-import cgi
+import html
 import json
 import sys
 import time
@@ -120,22 +120,40 @@ def _repr_json_(self):
         else:
             return json.dumps(obj)
 
+    @staticmethod
+    def _htmltable_escape(str_):
+        CHARS = {
+            '&':  r'\&',
+            '%':  r'\%',
+            '$':  r'\$',
+            '#':  r'\#',
+            '_':  r'\_',
+            '{':  r'\letteropenbrace{}',
+            '}':  r'\letterclosebrace{}',
+            '~':  r'\lettertilde{}',
+            '^':  r'\letterhat{}',
+            '\\': r'\letterbackslash{}',
+            '>':  r'\textgreater',
+            '<':  r'\textless',
+        }
+        return u"".join([CHARS.get(c, c) for c in str_])
+
     def _repr_html_(self):
 
-        html = "<table>"
-        html += "<tr><th>Software</th><th>Version</th></tr>"
+        html_table = "<table>"
+        html_table += "<tr><th>Software</th><th>Version</th></tr>"
         for name, version in self.packages:
-            _version = cgi.escape(version)
-            html += "<tr><td>%s</td><td>%s</td></tr>" % (name, _version)
+            _version = self._htmltable_escape(version)
+            html_table += "<tr><td>%s</td><td>%s</td></tr>" % (name, _version)
 
         try:
-            html += "<tr><td colspan='2'>%s</td></tr>" % time.strftime(timefmt)
+            html_table += "<tr><td colspan='2'>%s</td></tr>" % time.strftime(timefmt)
         except:
-            html += "<tr><td colspan='2'>%s</td></tr>" % \
+            html_table += "<tr><td colspan='2'>%s</td></tr>" % \
                 time.strftime(timefmt).decode(_date_format_encoding())
-        html += "</table>"
+        html_table += "</table>"
 
-        return html
+        return html_table
 
     @staticmethod
     def _latex_escape(str_):