Merge pull request #39 from pismute/escaping_headers

jacebrowning · jacebrowning · commit 70ecdeb73d67 · 2015-06-30T16:02:25.000-04:00
Headers should be escaped on browser
diff --git a/flask_api/templates/base.html b/flask_api/templates/base.html
@@ -117,7 +117,7 @@
             </div>
             <div class="response-info">
                 <pre class="prettyprint"><div class="meta nocode"><b>HTTP {{ status }}</b>{% autoescape off %}
-{% for key, val in headers.items() %}<b>{{ key }}:</b> <span class="lit">{{ val }}<!--{ val|break_long_headers|urlize_quoted_links }--></span>
+{% for key, val in headers.items() %}<b>{{ key }}:</b> <span class="lit">{{ val|e }}<!--{ val|break_long_headers|urlize_quoted_links }--></span>
 {% endfor %}
 </div>{% if content %}{{ content|urlize_quoted_links }}{% endif %}<!-- |urlize_quoted_links --></pre>{% endautoescape %}
             </div>
