occurs on both createaccount.cgi and the "log in" link at the bottom. this escaping might need to be done on both branches (password e-mailed, bogus e-mail address).

moving to real milestones...

This attachment patches CGI.pl's CheckEmailSyntax function to escape the characters < , > , and & in the invalid email address that gets displayed to the user as part of the error message when the user submits an invalid address. This method of filtering bad characters is generally considered less secure than the alternate approach of allowing good characters (see f.e. the CERT advisory linked from bug 38856). Is it sufficient in this situation? The most secure approach in this situation is not to display the invalid email address at all, which is the approach I took in the data validation error messages in bug 38854 and bug 38855.

Hmm... which one's better? Guess that's the question. Showing the e-mail address as typed allows the user to see if they made a typo so they can slap themselves on the forehead (BTW, that encoding could be done w/the 'html_quote()' sub). I think that would be considered "good enough" as it's the routine used to sanitize everything else sent to the user (such as this comment :)

OK, looks good to me. r=jake

r= justdave Checked in.

Moving to Bugzilla product