--- parser3/src/main/untaint.C 2004/02/06 09:25:22 1.127 +++ parser3/src/main/untaint.C 2004/02/27 12:57:46 1.131 @@ -1,11 +1,11 @@ /** @file Parser: String class part: untaint mechanizm. - Copyright(c) 2001-2003 ArtLebedev Group (http://www.artlebedev.com) + Copyright(c) 2001-2004 ArtLebedev Group (http://www.artlebedev.com) Author: Alexandr Petrosian (http://paf.design.ru) */ -static const char * const IDENT_UNTAINT_C="$Date: 2004/02/06 09:25:22 $"; +static const char * const IDENT_UNTAINT_C="$Date: 2004/02/27 12:57:46 $"; #include "pa_string.h" @@ -23,15 +23,10 @@ extern "C" { // author forgot to do that #include "ec.h" } -#define PA_SQL - -#ifdef PA_SQL #include "pa_sql_connection.h" -#endif // defines - #undef CORD_ec_append // redefining to intercept flushes and implement whitespace optimization // of all consequent white space chars leaving only first one @@ -39,7 +34,7 @@ extern "C" { // author forgot to do that { \ bool skip=false; \ if(optimize) switch(c) { \ - case ' ': case '\r': case '\n': case '\t': \ + case ' ': case '\n': case '\t': \ if(whitespace) \ skip=true; /*skipping subsequent*/ \ else \ @@ -376,12 +371,12 @@ int cstr_to_string_body_block(char alang bool email=false; uchar c; for(const char* src=mail_ptr; (c=(uchar)*src++); ) { - //RFC + An 'encoded-word' MUST NOT appear in any portion of an 'addr-spec'. - if(to_quoted_printable && (c==',' || addr_spec_soon(src) || c == '"')) { + if(to_quoted_printable && (c==',' || c == '"' || addr_spec_soon(src-1/*position to 'c'*/))) { email=c=='<'; to_string("?="); to_quoted_printable=false; } + //RFC + An 'encoded-word' MUST NOT appear in any portion of an 'addr-spec'. if(!email && ( !to_quoted_printable && (c & 0x80) // starting quote-printable-encoding on first 8bit char || to_quoted_printable && !mail_header_char_valid_within_Qencoded(c) @@ -412,7 +407,6 @@ int cstr_to_string_body_block(char alang _default; }); break; -#ifdef PA_SQL case String::L_SQL: // tainted, untaint language: sql if(info->connection) { @@ -426,7 +420,6 @@ int cstr_to_string_body_block(char alang 0, "untaint in SQL language failed - no connection specified"); break; -#endif case String::L_JS: escape(switch(c) { case '"': to_string("\\\""); break;