prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  DOC: XSS in quicktour/views/views.py
  http://docs.pylonsproject.org/projects/pyramid/en/latest/quick_tour.html#views
  
  https://github.com/Pylons/pyramid/blob/master/docs/quick_tour/views/views.py#L17
  
  As there is no templating layer to autoescape the user-supplied `name` parameter and the response is by default `text/html`, `hello_view` contains an XSS vulnerability.
  
  Templating is not the focus of (this part of) the quick tour.
  
  I can think of two approaches:
  1. Use `cgi.escape` before doing string interpolation (`body % cgi.escape(name)').
  2. Add a note about XSS and the value of utilizing a good templating engine with autoescape.
  
  "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" http://cwe.mitre.org/data/definitions/79.html
  
  
  </issue>
  <code>
  [start of docs/quick_tour/views/views.py]
  1 from pyramid.httpexceptions import HTTPFound
  2 from pyramid.response import Response
  3 from pyramid.view import view_config
  4 
  5 
  6 # First view, available at http://localhost:6543/
  7 @view_config(route_name='home')
  8 def home_view(request):
  9     return Response('<p>Visit <a href="/howdy?name=lisa">hello</a></p>')
  10 
  11 
  12 # /howdy?name=alice which links to the next view
  13 @view_config(route_name='hello')
  14 def hello_view(request):
  15     name = request.params.get('name', 'No Name')
  16     body = '<p>Hi %s, this <a href="/goto">redirects</a></p>'
  17     return Response(body % name)
  18 
  19 
  20 # /goto which issues HTTP redirect to the last view
  21 @view_config(route_name='redirect')
  22 def redirect_view(request):
  23     return HTTPFound(location="/problem")
  24 
  25 
  26 # /problem which causes an site error
  27 @view_config(route_name='exception')
  28 def exception_view(request):
  29     raise Exception()
  30
  [end of docs/quick_tour/views/views.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/docs/quick_tour/views/views.py b/docs/quick_tour/views/views.py
  --- a/docs/quick_tour/views/views.py
  +++ b/docs/quick_tour/views/views.py
  @@ -1,3 +1,5 @@
  +import cgi
  +
   from pyramid.httpexceptions import HTTPFound
   from pyramid.response import Response
   from pyramid.view import view_config
  @@ -14,7 +16,8 @@
   def hello_view(request):
       name = request.params.get('name', 'No Name')
       body = '<p>Hi %s, this <a href="/goto">redirects</a></p>'
  -    return Response(body % name)
  +    # cgi.escape to prevent Cross-Site Scripting (XSS) [CWE 79]
  +    return Response(body % cgi.escape(name))
   
   
   # /goto which issues HTTP redirect to the last view
  @@ -23,7 +26,7 @@
       return HTTPFound(location="/problem")
   
   
  -# /problem which causes an site error
  +# /problem which causes a site error
   @view_config(route_name='exception')
   def exception_view(request):
       raise Exception()
  
verification_info: {"golden_diff": "diff --git a/docs/quick_tour/views/views.py b/docs/quick_tour/views/views.py\n--- a/docs/quick_tour/views/views.py\n+++ b/docs/quick_tour/views/views.py\n@@ -1,3 +1,5 @@\n+import cgi\n+\n from pyramid.httpexceptions import HTTPFound\n from pyramid.response import Response\n from pyramid.view import view_config\n@@ -14,7 +16,8 @@\n def hello_view(request):\n     name = request.params.get('name', 'No Name')\n     body = '<p>Hi %s, this <a href=\"/goto\">redirects</a></p>'\n-    return Response(body % name)\n+    # cgi.escape to prevent Cross-Site Scripting (XSS) [CWE 79]\n+    return Response(body % cgi.escape(name))\n \n \n # /goto which issues HTTP redirect to the last view\n@@ -23,7 +26,7 @@\n     return HTTPFound(location=\"/problem\")\n \n \n-# /problem which causes an site error\n+# /problem which causes a site error\n @view_config(route_name='exception')\n def exception_view(request):\n     raise Exception()\n", "issue": "DOC: XSS in quicktour/views/views.py\nhttp://docs.pylonsproject.org/projects/pyramid/en/latest/quick_tour.html#views\n\nhttps://github.com/Pylons/pyramid/blob/master/docs/quick_tour/views/views.py#L17\n\nAs there is no templating layer to autoescape the user-supplied `name` parameter and the response is by default `text/html`, `hello_view` contains an XSS vulnerability.\n\nTemplating is not the focus of (this part of) the quick tour.\n\nI can think of two approaches:\n1. Use `cgi.escape` before doing string interpolation (`body % cgi.escape(name)').\n2. Add a note about XSS and the value of utilizing a good templating engine with autoescape.\n\n\"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\" http://cwe.mitre.org/data/definitions/79.html\n\n", "before_files": [{"content": "from pyramid.httpexceptions import HTTPFound\nfrom pyramid.response import Response\nfrom pyramid.view import view_config\n\n\n# First view, available at http://localhost:6543/\n@view_config(route_name='home')\ndef home_view(request):\n    return Response('<p>Visit <a href=\"/howdy?name=lisa\">hello</a></p>')\n\n\n# /howdy?name=alice which links to the next view\n@view_config(route_name='hello')\ndef hello_view(request):\n    name = request.params.get('name', 'No Name')\n    body = '<p>Hi %s, this <a href=\"/goto\">redirects</a></p>'\n    return Response(body % name)\n\n\n# /goto which issues HTTP redirect to the last view\n@view_config(route_name='redirect')\ndef redirect_view(request):\n    return HTTPFound(location=\"/problem\")\n\n\n# /problem which causes an site error\n@view_config(route_name='exception')\ndef exception_view(request):\n    raise Exception()\n", "path": "docs/quick_tour/views/views.py"}]}