lib/html_quote.c

   1 /*
   2  * $Id$
   3  *
   4  * DEBUG:
   5  * AUTHOR: Robert Collins
   6  *
   7  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   8  * ----------------------------------------------------------
   9  *
  10  *  Squid is the result of efforts by numerous individuals from
  11  *  the Internet community; see the CONTRIBUTORS file for full
  12  *  details.   Many organizations have provided support for Squid's
  13  *  development; see the SPONSORS file for full details.  Squid is
  14  *  Copyrighted (C) 2001 by the Regents of the University of
  15  *  California; see the COPYRIGHT file for full details.  Squid
  16  *  incorporates software developed and/or copyrighted by other
  17  *  sources; see the CREDITS file for full details.
  18  *
  19  *  This program is free software; you can redistribute it and/or modify
  20  *  it under the terms of the GNU General Public License as published by
  21  *  the Free Software Foundation; either version 2 of the License, or
  22  *  (at your option) any later version.
  23  *
  24  *  This program is distributed in the hope that it will be useful,
  25  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  26  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27  *  GNU General Public License for more details.
  28  *
  29  *  You should have received a copy of the GNU General Public License
  30  *  along with this program; if not, write to the Free Software
  31  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  32  *
  33  */
  34
  35 #include "squid.h"
  36 #include "html_quote.h"
  37
  38 #if HAVE_STDIO_H
  39 #include <stdio.h>
  40 #endif
  41 #if HAVE_STRING_H
  42 #include <string.h>
  43 #endif
  44
  45 /*
  46  *  HTML defines these characters as special entities that should be quoted.
  47  */
  48 static struct {
  49     unsigned char code;
  50     const char *quote;
  51 } htmlstandardentities[] =
  52
  53 {
  54     /* NOTE: The quoted form MUST not be larger than 6 character.
  55      * see close to the MemPool commend below
  56      */
  57     {
  58         '<', "&lt;"
  59     },
  60     {
  61         '>', "&gt;"
  62     },
  63     {
  64         '"', "&quot;"
  65     },
  66     {
  67         '&', "&amp;"
  68     },
  69     {
  70         '\'', "&#39;"
  71     },
  72     {
  73         0, NULL
  74     }
  75 };
  76
  77 /*
  78  *  html_do_quote - Returns a static buffer containing the quoted
  79  *  string.
  80  */
  81 char *
  82 html_quote(const char *string)
  83 {
  84     static char *buf;
  85     static size_t bufsize = 0;
  86     const char *src;
  87     char *dst;
  88     int i;
  89
  90     /* XXX This really should be implemented using a MemPool, but
  91      * MemPools are not yet available in lib...
  92      */
  93     if (buf == NULL || strlen(string) * 6 > bufsize) {
  94         xfree(buf);
  95         bufsize = strlen(string) * 6 + 1;
  96         buf = xcalloc(bufsize, 1);
  97     }
  98     for (src = string, dst = buf; *src; src++) {
  99         const char *escape = NULL;
 100         const unsigned char ch = *src;
 101
 102         /* Walk thru the list of HTML Entities that must be quoted to
 103          * display safely
 104          */
 105         for (i = 0; htmlstandardentities[i].code; i++) {
 106             if (ch == htmlstandardentities[i].code) {
 107                 escape = htmlstandardentities[i].quote;
 108                 break;
 109             }
 110         }
 111         /* Encode control chars just to be on the safe side, and make
 112          * sure all 8-bit characters are encoded to protect from buggy
 113          * clients
 114          */
 115         if (!escape && (ch <= 0x1F || ch >= 0x7f) && ch != '\n' && ch != '\r' && ch != '\t') {
 116             static char dec_encoded[7];
 117             snprintf(dec_encoded, sizeof dec_encoded, "&#%3d;", (int) ch);
 118             escape = dec_encoded;
 119         }
 120         if (escape) {
 121             /* Ok, An escaped form was found above. Use it */
 122             strncpy(dst, escape, 6);
 123             dst += strlen(escape);
 124         } else {
 125             /* Apparently there is no need to escape this character */
 126             *dst++ = ch;
 127         }
 128     }
 129     /* Nullterminate and return the result */
 130     *dst = '\0';
 131     return (buf);
 132 }