parser3/src/main/untaint.C - diff

Return to untaint.C CVS log

Up to [parser3project] / parser3 / src / main

Diff for /parser3/src/main/untaint.C between versions 1.118.2.5 and 1.122.2.2

version 1.118.2.5, 2003/09/23 14:07:49	version 1.122.2.2, 2004/01/22 08:28:20
Line 72 extern "C" { // author forgot to do that	Line 72 extern "C" { // author forgot to do that
CORD_ec_append(info->result, hex[((unsigned char)c)%0x10]); \	CORD_ec_append(info->result, hex[((unsigned char)c)%0x10]); \
} else \	} else \
CORD_ec_append(info->result, otherwise);	CORD_ec_append(info->result, otherwise);
#define to_char(c) CORD_ec_append(info->result, c)	#define to_char(c) { CORD_ec_append(info->result, c); whitespace=false; }
#define to_string(s) CORD_ec_append_cord(info->result, s)	#define to_string(s) { CORD_ec_append_cord(info->result, s); whitespace=false; }

inline bool need_file_encode(unsigned char c){	inline bool need_file_encode(unsigned char c){
// russian letters and space ENABLED	// russian letters and space ENABLED
Line 170 inline bool need_quote_http_header(const	Line 170 inline bool need_quote_http_header(const
#ifndef DOXYGEN	#ifndef DOXYGEN
struct Append_fragment_info {	struct Append_fragment_info {
String::Language lang;	String::Language lang;
const StringBody dest_body;
String::Languages* dest_languages;	String::Languages* dest_languages;
size_t dest_body_plan_length;	size_t dest_body_plan_length;
};	};
Line 182 int append_fragment_optimizing(char alan	Line 181 int append_fragment_optimizing(char alan
// clean piece would be marked OPTIMIZED manually	// clean piece would be marked OPTIMIZED manually
// pieces with determined languages [not tainted\|clean] would retain theirs langs	// pieces with determined languages [not tainted\|clean] would retain theirs langs
info->dest_languages->append(info->dest_body_plan_length,	info->dest_languages->append(info->dest_body_plan_length,
lang==String::Language::L_TAINTED?	lang==String::L_TAINTED?
info->lang	info->lang
:lang==String::Language::L_CLEAN?	:lang==String::L_CLEAN?
(String::Language)(String::Language::L_CLEAN\|String::Language::L_OPTIMIZE_BIT) // ORing with OPTIMIZED flag	(String::Language)(String::L_CLEAN\|String::L_OPTIMIZE_BIT) // ORing with OPTIMIZED flag
:lang,	:lang,
asize);	asize);
info->dest_body_plan_length+=asize;	info->dest_body_plan_length+=asize;
Line 196 int append_fragment_nonoptimizing(char a	Line 195 int append_fragment_nonoptimizing(char a
const String::Language lang=(String::Language)(unsigned char)alang;	const String::Language lang=(String::Language)(unsigned char)alang;
// The core idea: tainted pieces got marked with context's lang	// The core idea: tainted pieces got marked with context's lang
info->dest_languages->append(info->dest_body_plan_length,	info->dest_languages->append(info->dest_body_plan_length,
lang==String::Language::L_TAINTED?	lang==String::L_TAINTED?
info->lang	info->lang
:lang,	:lang,
asize);	asize);
Line 222 String& String::append_to(String& dest,	Line 221 String& String::append_to(String& dest,
else if(forced) //forcing passed lang?	else if(forced) //forcing passed lang?
dest.langs.append(dest.body, lang, length());	dest.langs.append(dest.body, lang, length());
else {	else {
Append_fragment_info info={lang, dest.body, &dest.langs, dest.body.length()};	Append_fragment_info info={lang, &dest.langs, dest.body.length()};
langs.for_each(body, lang&L_OPTIMIZE_BIT?	langs.for_each(body, lang&L_OPTIMIZE_BIT?
append_fragment_optimizing	append_fragment_optimizing
:append_fragment_nonoptimizing, &info);	:append_fragment_nonoptimizing, &info);
Line 314 struct Cstr_to_string_body_block_info {	Line 313 struct Cstr_to_string_body_block_info {
String::Language lang;	String::Language lang;
SQL_Connection* connection;	SQL_Connection* connection;
const Request_charsets* charsets;	const Request_charsets* charsets;
const StringBody* body;	const String::Body* body;

// output	// output
CORD_ec result;	CORD_ec result;
Line 332 int cstr_to_string_body_block(char alang	Line 331 int cstr_to_string_body_block(char alang
//fprintf(stderr, "%d, %d\n", fragment.lang, fragment.length);	//fprintf(stderr, "%d, %d\n", fragment.lang, fragment.length);


String::Language to_lang=info->lang==String::Language::L_UNSPECIFIED?fragment_lang:info->lang;	String::Language to_lang=info->lang==String::L_UNSPECIFIED?fragment_lang:info->lang;
bool optimize=(to_lang & String::Language::L_OPTIMIZE_BIT)!=0;	bool optimize=(to_lang & String::L_OPTIMIZE_BIT)!=0;
if(!optimize)	if(!optimize)
whitespace=false;	whitespace=false;

switch(to_lang & ~String::Language::L_OPTIMIZE_BIT) {	switch(to_lang & ~String::L_OPTIMIZE_BIT) {
case String::Language::L_CLEAN:	case String::L_CLEAN:
case String::Language::L_TAINTED:	case String::L_TAINTED:
case String::Language::L_AS_IS:	case String::L_AS_IS:
// clean piece	// clean piece

// tainted piece, but undefined untaint language	// tainted piece, but undefined untaint language
Line 350 int cstr_to_string_body_block(char alang	Line 349 int cstr_to_string_body_block(char alang
// tainted, untaint language: as-is	// tainted, untaint language: as-is
ec_append(info->result, optimize, whitespace, info->pos, fragment_length);	ec_append(info->result, optimize, whitespace, info->pos, fragment_length);
break;	break;
case String::Language::L_FILE_SPEC:	case String::L_FILE_SPEC:
// tainted, untaint language: file [name]	// tainted, untaint language: file [name]
escape(	escape(
// Macintosh has problems with small Russian letter 'r'	// Macintosh has problems with small Russian letter 'r'
Line 361 int cstr_to_string_body_block(char alang	Line 360 int cstr_to_string_body_block(char alang
encode(need_file_encode, '_', c);	encode(need_file_encode, '_', c);
);	);
break;	break;
case String::Language::L_URI:	case String::L_URI:
// tainted, untaint language: uri	// tainted, untaint language: uri
{	{
const char *fragment_str=info->body->mid(info->fragment_begin, fragment_length).cstr();	const char *fragment_str=info->body->mid(info->fragment_begin, fragment_length).cstr();
Line 378 int cstr_to_string_body_block(char alang	Line 377 int cstr_to_string_body_block(char alang
encode(need_uri_encode, '%', c);	encode(need_uri_encode, '%', c);
}	}
break;	break;
case String::Language::L_HTTP_HEADER:	case String::L_HTTP_HEADER:
// tainted, untaint language: http-field-content-text	// tainted, untaint language: http-field-content-text
escape(	escape(
encode(need_uri_encode, '%', c);	encode(need_uri_encode, '%', c);
);	);
break;	break;
case String::Language::L_MAIL_HEADER:	case String::L_MAIL_HEADER:
// tainted, untaint language: mail-header	// tainted, untaint language: mail-header
// http://www.ietf.org/rfc/rfc2047.txt	// http://www.ietf.org/rfc/rfc2047.txt
if(info->charsets) {	if(info->charsets) {
Line 430 int cstr_to_string_body_block(char alang	Line 429 int cstr_to_string_body_block(char alang
} else	} else
ec_append(info->result, optimize, whitespace, info->pos, fragment_length);	ec_append(info->result, optimize, whitespace, info->pos, fragment_length);
break;	break;
case String::Language::L_TABLE:	case String::L_TABLE:
// tainted, untaint language: table	// tainted, untaint language: table
escape(switch(c) {	escape(switch(c) {
case '\t': to_char(' '); break;	case '\t': to_char(' '); break;
Line 439 int cstr_to_string_body_block(char alang	Line 438 int cstr_to_string_body_block(char alang
});	});
break;	break;
#ifdef PA_SQL	#ifdef PA_SQL
case String::Language::L_SQL:	case String::L_SQL:
// tainted, untaint language: sql	// tainted, untaint language: sql
if(info->connection) {	if(info->connection) {
const char *fragment_str=info->body->mid(info->fragment_begin, fragment_length).cstr();	const char *fragment_str=info->body->mid(info->fragment_begin, fragment_length).cstr();
Line 453 int cstr_to_string_body_block(char alang	Line 452 int cstr_to_string_body_block(char alang
"untaint in SQL language failed - no connection specified");	"untaint in SQL language failed - no connection specified");
break;	break;
#endif	#endif
case String::Language::L_JS:	case String::L_JS:
escape(switch(c) {	escape(switch(c) {
case '"': to_string("\\\""); break;	case '"': to_string("\\\""); break;
case '\'': to_string("\\'"); break;	case '\'': to_string("\\'"); break;
Line 463 int cstr_to_string_body_block(char alang	Line 462 int cstr_to_string_body_block(char alang
_default;	_default;
});	});
break;	break;
case String::Language::L_XML:	case String::L_XML:
escape(switch(c) {	escape(switch(c) {
case '&': to_string("&"); break;	case '&': to_string("&"); break;
case '>': to_string(">"); break;	case '>': to_string(">"); break;
Line 473 int cstr_to_string_body_block(char alang	Line 472 int cstr_to_string_body_block(char alang
_default;	_default;
});	});
break;	break;
case String::Language::L_HTML:	case String::L_HTML:
escape(switch(c) {	escape(switch(c) {
case '&': to_string("&"); break;	case '&': to_string("&"); break;
case '>': to_string(">"); break;	case '>': to_string(">"); break;
Line 495 int cstr_to_string_body_block(char alang	Line 494 int cstr_to_string_body_block(char alang
}	}


StringBody String::cstr_to_string_body(Language lang,	String::Body String::cstr_to_string_body(Language lang,
SQL_Connection* connection,	SQL_Connection* connection,
const Request_charsets *charsets) const {	const Request_charsets *charsets) const {

Line 515 StringBody String::cstr_to_string_body(L	Line 514 StringBody String::cstr_to_string_body(L
if(!is_empty())	if(!is_empty())
langs.for_each(body, cstr_to_string_body_block, &info);	langs.for_each(body, cstr_to_string_body_block, &info);

return StringBody(CORD_ec_to_cord(info.result));	return String::Body(CORD_ec_to_cord(info.result));
}	}

E-mail:

Removed from v.1.118.2.5
changed lines
	Added in v.1.122.2.2