From 880b92d7243dcf2b83bf31dc365a858d8b5e6767 Mon Sep 17 00:00:00 2001 From: "Yue (Knox) Liu" <64764840+yueyueL@users.noreply.github.com> Date: Thu, 27 Nov 2025 03:58:33 +0800 Subject: [PATCH] Merge commit from fork * Sanitize error message output Escape HTML characters in error message for security. * Update CHANGELOG.md --------- Co-authored-by: Niko --- CHANGELOG.md | 1 + spotipy/oauth2.py | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ee0caac..62053dd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,7 @@ Add your changes below. - Fixed dead link in README.md - Corrected Spotify/Spotipy typo in documentation +- Sanitize HTML error message output for OAuth flow ### Removed diff --git a/spotipy/oauth2.py b/spotipy/oauth2.py index 23e3faf..60f00b9 100644 --- a/spotipy/oauth2.py +++ b/spotipy/oauth2.py @@ -8,6 +8,7 @@ __all__ = [ ] import base64 +import html import logging import os import time @@ -1252,7 +1253,7 @@ class RequestHandler(BaseHTTPRequestHandler): if self.server.auth_code: status = "successful" elif self.server.error: - status = f"failed ({self.server.error})" + status = f"failed ({html.escape(str(self.server.error))})" else: self._write("

Invalid request

") return