prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  DOC: XSS in quicktour/views/views.py
  http://docs.pylonsproject.org/projects/pyramid/en/latest/quick_tour.html#views
  
  https://github.com/Pylons/pyramid/blob/master/docs/quick_tour/views/views.py#L17
  
  As there is no templating layer to autoescape the user-supplied `name` parameter and the response is by default `text/html`, `hello_view` contains an XSS vulnerability.
  
  Templating is not the focus of (this part of) the quick tour.
  
  I can think of two approaches:
  1. Use `cgi.escape` before doing string interpolation (`body % cgi.escape(name)').
  2. Add a note about XSS and the value of utilizing a good templating engine with autoescape.
  
  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" http://cwe.mitre.org/data/definitions/79.html
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `docs/quick_tour/views/views.py`
  Content:
  ```
  1 from pyramid.httpexceptions import HTTPFound
  2 from pyramid.response import Response
  3 from pyramid.view import view_config
  4 
  5 
  6 # First view, available at http://localhost:6543/
  7 @view_config(route_name='home')
  8 def home_view(request):
  9     return Response('<p>Visit <a href="/howdy?name=lisa">hello</a></p>')
  10 
  11 
  12 # /howdy?name=alice which links to the next view
  13 @view_config(route_name='hello')
  14 def hello_view(request):
  15     name = request.params.get('name', 'No Name')
  16     body = '<p>Hi %s, this <a href="/goto">redirects</a></p>'
  17     return Response(body % name)
  18 
  19 
  20 # /goto which issues HTTP redirect to the last view
  21 @view_config(route_name='redirect')
  22 def redirect_view(request):
  23     return HTTPFound(location="/problem")
  24 
  25 
  26 # /problem which causes an site error
  27 @view_config(route_name='exception')
  28 def exception_view(request):
  29     raise Exception()
  30
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/docs/quick_tour/views/views.py b/docs/quick_tour/views/views.py
  --- a/docs/quick_tour/views/views.py
  +++ b/docs/quick_tour/views/views.py
  @@ -1,3 +1,5 @@
  +import cgi
  +
   from pyramid.httpexceptions import HTTPFound
   from pyramid.response import Response
   from pyramid.view import view_config
  @@ -14,7 +16,8 @@
   def hello_view(request):
       name = request.params.get('name', 'No Name')
       body = '<p>Hi %s, this <a href="/goto">redirects</a></p>'
  -    return Response(body % name)
  +    # cgi.escape to prevent Cross-Site Scripting (XSS) [CWE 79]
  +    return Response(body % cgi.escape(name))
   
   
   # /goto which issues HTTP redirect to the last view
  @@ -23,7 +26,7 @@
       return HTTPFound(location="/problem")
   
   
  -# /problem which causes an site error
  +# /problem which causes a site error
   @view_config(route_name='exception')
   def exception_view(request):
       raise Exception()
  
verification_info: {"golden_diff": "diff --git a/docs/quick_tour/views/views.py b/docs/quick_tour/views/views.py\n--- a/docs/quick_tour/views/views.py\n+++ b/docs/quick_tour/views/views.py\n@@ -1,3 +1,5 @@\n+import cgi\n+\n from pyramid.httpexceptions import HTTPFound\n from pyramid.response import Response\n from pyramid.view import view_config\n@@ -14,7 +16,8 @@\n def hello_view(request):\n     name = request.params.get('name', 'No Name')\n     body = '<p>Hi %s, this <a href=\"/goto\">redirects</a></p>'\n-    return Response(body % name)\n+    # cgi.escape to prevent Cross-Site Scripting (XSS) [CWE 79]\n+    return Response(body % cgi.escape(name))\n \n \n # /goto which issues HTTP redirect to the last view\n@@ -23,7 +26,7 @@\n     return HTTPFound(location=\"/problem\")\n \n \n-# /problem which causes an site error\n+# /problem which causes a site error\n @view_config(route_name='exception')\n def exception_view(request):\n     raise Exception()\n", "issue": "DOC: XSS in quicktour/views/views.py\nhttp://docs.pylonsproject.org/projects/pyramid/en/latest/quick_tour.html#views\n\nhttps://github.com/Pylons/pyramid/blob/master/docs/quick_tour/views/views.py#L17\n\nAs there is no templating layer to autoescape the user-supplied `name` parameter and the response is by default `text/html`, `hello_view` contains an XSS vulnerability.\n\nTemplating is not the focus of (this part of) the quick tour.\n\nI can think of two approaches:\n1. Use `cgi.escape` before doing string interpolation (`body % cgi.escape(name)').\n2. Add a note about XSS and the value of utilizing a good templating engine with autoescape.\n\n\"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\" http://cwe.mitre.org/data/definitions/79.html\n\n", "before_files": [{"content": "from pyramid.httpexceptions import HTTPFound\nfrom pyramid.response import Response\nfrom pyramid.view import view_config\n\n\n# First view, available at http://localhost:6543/\n@view_config(route_name='home')\ndef home_view(request):\n    return Response('<p>Visit <a href=\"/howdy?name=lisa\">hello</a></p>')\n\n\n# /howdy?name=alice which links to the next view\n@view_config(route_name='hello')\ndef hello_view(request):\n    name = request.params.get('name', 'No Name')\n    body = '<p>Hi %s, this <a href=\"/goto\">redirects</a></p>'\n    return Response(body % name)\n\n\n# /goto which issues HTTP redirect to the last view\n@view_config(route_name='redirect')\ndef redirect_view(request):\n    return HTTPFound(location=\"/problem\")\n\n\n# /problem which causes an site error\n@view_config(route_name='exception')\ndef exception_view(request):\n    raise Exception()\n", "path": "docs/quick_tour/views/views.py"}], "after_files": [{"content": "import cgi\n\nfrom pyramid.httpexceptions import HTTPFound\nfrom pyramid.response import Response\nfrom pyramid.view import view_config\n\n\n# First view, available at http://localhost:6543/\n@view_config(route_name='home')\ndef home_view(request):\n    return Response('<p>Visit <a href=\"/howdy?name=lisa\">hello</a></p>')\n\n\n# /howdy?name=alice which links to the next view\n@view_config(route_name='hello')\ndef hello_view(request):\n    name = request.params.get('name', 'No Name')\n    body = '<p>Hi %s, this <a href=\"/goto\">redirects</a></p>'\n    # cgi.escape to prevent Cross-Site Scripting (XSS) [CWE 79]\n    return Response(body % cgi.escape(name))\n\n\n# /goto which issues HTTP redirect to the last view\n@view_config(route_name='redirect')\ndef redirect_view(request):\n    return HTTPFound(location=\"/problem\")\n\n\n# /problem which causes a site error\n@view_config(route_name='exception')\ndef exception_view(request):\n    raise Exception()\n", "path": "docs/quick_tour/views/views.py"}]}