bpo-38243: Escape the server_title of DocXMLRPCServer when rendering

Author: corona10

Lib/xmlrpc/server.py

@@ -108,6 +108,7 @@ def export_add(self, x, y):
 from http.server import BaseHTTPRequestHandler
 from functools import partial
 from inspect import signature
+import html
 import http.server
 import socketserver
 import sys
@@ -894,7 +895,7 @@ def generate_html_documentation(self):
                                 methods
                             )
 
-        return documenter.page(self.server_title, documentation)
+        return documenter.page(html.escape(self.server_title), documentation)
 
 class DocXMLRPCRequestHandler(SimpleXMLRPCRequestHandler):
     """XML-RPC and documentation request handler class.

Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst

@@ -0,0 +1,2 @@
+Escape the server_title of :class:`DocXMLRPCServer` when rendering the
+document page. (Contributed by Dong-hee Na in :issue:`38243`.)