lib/html_quote.c

   1 /*
   2  * DEBUG:
   3  * AUTHOR: Robert Collins
   4  *
   5  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   6  * ----------------------------------------------------------
   7  *
   8  *  Squid is the result of efforts by numerous individuals from
   9  *  the Internet community; see the CONTRIBUTORS file for full
  10  *  details.   Many organizations have provided support for Squid's
  11  *  development; see the SPONSORS file for full details.  Squid is
  12  *  Copyrighted (C) 2001 by the Regents of the University of
  13  *  California; see the COPYRIGHT file for full details.  Squid
  14  *  incorporates software developed and/or copyrighted by other
  15  *  sources; see the CREDITS file for full details.
  16  *
  17  *  This program is free software; you can redistribute it and/or modify
  18  *  it under the terms of the GNU General Public License as published by
  19  *  the Free Software Foundation; either version 2 of the License, or
  20  *  (at your option) any later version.
  21  *
  22  *  This program is distributed in the hope that it will be useful,
  23  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  24  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25  *  GNU General Public License for more details.
  26  *
  27  *  You should have received a copy of the GNU General Public License
  28  *  along with this program; if not, write to the Free Software
  29  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  30  *
  31  */
  32
  33 #include "squid.h"
  34 #include "html_quote.h"
  35
  36 #if HAVE_STDIO_H
  37 #include <stdio.h>
  38 #endif
  39 #if HAVE_STRING_H
  40 #include <string.h>
  41 #endif
  42
  43 /*
  44  *  HTML defines these characters as special entities that should be quoted.
  45  */
  46 static struct {
  47     unsigned char code;
  48     const char *quote;
  49 } htmlstandardentities[] =
  50
  51 {
  52     /* NOTE: The quoted form MUST not be larger than 6 character.
  53      * see close to the MemPool commend below
  54      */
  55     {
  56         '<', "&lt;"
  57     },
  58     {
  59         '>', "&gt;"
  60     },
  61     {
  62         '"', "&quot;"
  63     },
  64     {
  65         '&', "&amp;"
  66     },
  67     {
  68         '\'', "&#39;"
  69     },
  70     {
  71         0, NULL
  72     }
  73 };
  74
  75 /*
  76  *  html_do_quote - Returns a static buffer containing the quoted
  77  *  string.
  78  */
  79 char *
  80 html_quote(const char *string)
  81 {
  82     static char *buf;
  83     static size_t bufsize = 0;
  84     const char *src;
  85     char *dst;
  86     int i;
  87
  88     /* XXX This really should be implemented using a MemPool, but
  89      * MemPools are not yet available in lib...
  90      */
  91     if (buf == NULL || strlen(string) * 6 > bufsize) {
  92         xfree(buf);
  93         bufsize = strlen(string) * 6 + 1;
  94         buf = xcalloc(bufsize, 1);
  95     }
  96     for (src = string, dst = buf; *src; src++) {
  97         const char *escape = NULL;
  98         const unsigned char ch = *src;
  99
 100         /* Walk thru the list of HTML Entities that must be quoted to
 101          * display safely
 102          */
 103         for (i = 0; htmlstandardentities[i].code; i++) {
 104             if (ch == htmlstandardentities[i].code) {
 105                 escape = htmlstandardentities[i].quote;
 106                 break;
 107             }
 108         }
 109         /* Encode control chars just to be on the safe side, and make
 110          * sure all 8-bit characters are encoded to protect from buggy
 111          * clients
 112          */
 113         if (!escape && (ch <= 0x1F || ch >= 0x7f) && ch != '\n' && ch != '\r' && ch != '\t') {
 114             static char dec_encoded[7];
 115             snprintf(dec_encoded, sizeof dec_encoded, "&#%3d;", (int) ch);
 116             escape = dec_encoded;
 117         }
 118         if (escape) {
 119             /* Ok, An escaped form was found above. Use it */
 120             strncpy(dst, escape, 6);
 121             dst += strlen(escape);
 122         } else {
 123             /* Apparently there is no need to escape this character */
 124             *dst++ = ch;
 125         }
 126     }
 127     /* Nullterminate and return the result */
 128     *dst = '\0';
 129     return (buf);
 130 }