--- parser3/src/main/untaint.C 2003/03/20 09:41:47 1.115.2.12.2.4 +++ parser3/src/main/untaint.C 2003/03/24 14:53:58 1.115.2.12.2.11 @@ -5,7 +5,7 @@ Author: Alexandr Petrosian (http://paf.design.ru) */ -static const char* IDENT_UNTAINT_C="$Date: 2003/03/20 09:41:47 $"; +static const char* IDENT_UNTAINT_C="$Date: 2003/03/24 14:53:58 $"; #include "pa_string.h" @@ -18,7 +18,9 @@ static const char* IDENT_UNTAINT_C="$Dat #include "pa_charset.h" #include "pa_request_charsets.h" +extern "C" { // author forgot to do that #include "ec.h" +} //#define PA_SQL @@ -27,7 +29,7 @@ static const char* IDENT_UNTAINT_C="$Dat #endif #define escape(action) \ - for(; fragment_size--; CORD_next(pos)) { \ + for(; fragment_length--; CORD_next(pos)) { \ char c=CORD_pos_fetch(pos); \ action \ } @@ -142,20 +144,20 @@ inline bool need_quote_http_header(const or marking ALL pieces of it with a @a lang when @a forced to, and propagating OPTIMIZE language bit. */ -String& String::append_to(String& dest, Untaint_lang lang, bool forced) const { - if(!*this) +String& String::append_to(String& dest, Language lang, bool forced) const { + if(is_empty()) return dest; // first: letters - dest.body=CORD_cat(dest.body, body); + dest.body.append(body); // next: fragment infos - if(lang==UL_PASS_APPENDED) // without language-chage string? - dest.fragments.append(fragments, 0, fragments.count()); + if(lang==L_PASS_APPENDED) // without language-chage string? + dest.fragments.append(fragments); else if(forced) //forcing passed lang? - dest.fragments+=Fragment(lang, size()); - else if(lang&UL_OPTIMIZE_BIT) { + dest.fragments+=Fragment(lang, length()); + else if(lang&L_OPTIMIZE_BIT) { Array_iterator i(fragments); while(i.has_next()) { const Fragment& fragment=i.next(); @@ -163,19 +165,19 @@ String& String::append_to(String& dest, // tainted piece would get OPTIMIZED bit from 'lang' // clean piece would be marked OPTIMIZED manually // pieces with determined languages [not tainted|clean] would retain theirs langs - dest.fragments+=Fragment(static_cast( - fragment.lang==UL_TAINTED?lang:( - fragment.lang==UL_CLEAN?UL_CLEAN|UL_OPTIMIZE_BIT: // ORing with OPTIMIZED flag + dest.fragments+=Fragment(static_cast( + fragment.lang==L_TAINTED?lang:( + fragment.lang==L_CLEAN?L_CLEAN|L_OPTIMIZE_BIT: // ORing with OPTIMIZED flag fragment.lang)), - fragment.size); + fragment.length); } } else { // The core idea: tainted pieces got marked with context's lang Array_iterator i(fragments); while(i.has_next()) { const Fragment& fragment=i.next(); dest.fragments+=Fragment( - fragment.lang==UL_TAINTED?lang:fragment.lang, - fragment.size); + fragment.lang==L_TAINTED?lang:fragment.lang, + fragment.length); } } @@ -215,33 +217,33 @@ inline bool mail_header_char_valid_withi || c>='0' && c<='9' || strchr("!*+-/", c); } -inline void ec_append(CORD_ec result, CORD_pos& pos, size_t size) { +inline void ec_append(CORD_ec& result, CORD_pos& pos, size_t size) { while(size--) { CORD_ec_append(result, CORD_pos_fetch(pos)); CORD_next(pos); } } -CORD String::cstr_to_cord(Untaint_lang lang, - SQL_Connection *connection, +StringBody String::cstr_to_string_body(Language lang, + SQL_Connection* connection, const Request_charsets *charsets) const { CORD_ec result; CORD_ec_init(result); - CORD_pos pos; CORD_set_pos(pos, body, 0); + CORD_pos pos; body.set_pos(pos, 0); bool whitespace=true; - size_t fragment_start=0; + size_t fragment_begin=0; size_t fragment_end; - for(Array_iterator i(fragments); i.has_next(); fragment_start=fragment_end) { + for(Array_iterator i(fragments); i.has_next(); fragment_begin=fragment_end) { const Fragment& fragment=i.next(); - size_t fragment_size=fragment.size; - fragment_end=fragment_start+fragment_size; + size_t fragment_length=fragment.length; + fragment_end=fragment_begin+fragment_length; - Untaint_lang to_lang=lang==UL_UNSPECIFIED?fragment.lang:lang; + Language to_lang=lang==L_UNSPECIFIED?fragment.lang:lang; - switch(to_lang & ~UL_OPTIMIZE_BIT) { - case UL_CLEAN: - case UL_TAINTED: - case UL_AS_IS: + switch(to_lang & ~L_OPTIMIZE_BIT) { + case L_CLEAN: + case L_TAINTED: + case L_AS_IS: // clean piece // tainted piece, but undefined untaint language @@ -249,9 +251,9 @@ CORD String::cstr_to_cord(Untaint_lang l // for ^process{body} evaluation // tainted, untaint language: as-is - ec_append(result, pos, fragment_size); + ec_append(result, pos, fragment_length); break; - case UL_FILE_SPEC: + case L_FILE_SPEC: // tainted, untaint language: file [name] escape( // Macintosh has problems with small Russian letter 'r' @@ -262,21 +264,22 @@ CORD String::cstr_to_cord(Untaint_lang l encode(need_file_encode, '_'); ); break; - case UL_URI: +#ifdef LATER + case L_URI: // tainted, untaint language: uri { const char *substr= CORD_to_const_char_star( - CORD_substr(body, fragment_start, fragment_size)); + CORD_substr(body, fragment_begin, fragment_length)); const void *client_ptr; size_t client_size; if(charsets) Charset::transcode( - charsets->source(), substr, fragment_size, + charsets->source(), substr, fragment_length, charsets->client(), client_ptr, client_size); else { client_ptr=substr; - client_size=fragment_size; + client_size=fragment_length; } char c; @@ -284,19 +287,20 @@ CORD String::cstr_to_cord(Untaint_lang l encode(need_uri_encode, '%'); } break; - case UL_HTTP_HEADER: +#endif + case L_HTTP_HEADER: // tainted, untaint language: http-field-content-text escape( encode(need_uri_encode, '%'); ); break; #ifdef LATER - case UL_MAIL_HEADER: + case L_MAIL_HEADER: // tainted, untaint language: mail-header // http://www.ietf.org/rfc/rfc2047.txt if(charsets) { const void *mail_ptr=fragment.ptr; - size_t mail_size=fragment_size; + size_t mail_size=fragment_length; const char* charset_name=charsets->mail().name()->cstr(); // Subject: Re: parser3: =?koi8-r?Q?=D3=C5=CD=C9=CE=C1=D2?= @@ -333,12 +337,12 @@ CORD String::cstr_to_cord(Untaint_lang l dest+=sprintf(dest, "?="); } else { - memcpy(dest, fragment.ptr, fragment_size); - dest+=fragment_size; + memcpy(dest, fragment.ptr, fragment_length); + dest+=fragment_length; } break; #endif - case UL_TABLE: + case L_TABLE: // tainted, untaint language: table escape(switch(c) { case '\t': to_char(' '); break; @@ -347,22 +351,22 @@ CORD String::cstr_to_cord(Untaint_lang l }); break; #ifdef PA_SQL - case UL_SQL: + case L_SQL: // tainted, untaint language: sql if(connection) { dest+=connection->quote(0, - CORD_substr(body, fragment_start, fragment_size), - fragment_size); + CORD_substr(body, fragment_begin, fragment_length), + fragment_length); ...^^^ - dest+=connection->quote(dest, fragment.ptr, fragment_size); + dest+=connection->quote(dest, fragment.ptr, fragment_length); else throw Exception(0, 0, "untaint in SQL language failed - no connection specified"); break; #endif - case UL_JS: + case L_JS: escape(switch(c) { case '"': to_string("\\\""); break; case '\'': to_string("\\'"); break; @@ -372,7 +376,7 @@ CORD String::cstr_to_cord(Untaint_lang l _default; }); break; - case UL_XML: + case L_XML: escape(switch(c) { case '&': to_string("&"); break; case '>': to_string(">"); break; @@ -382,7 +386,7 @@ CORD String::cstr_to_cord(Untaint_lang l _default; }); break; - case UL_HTML: + case L_HTML: escape(switch(c) { case '&': to_string("&"); break; case '>': to_string(">"); break; @@ -399,7 +403,7 @@ CORD String::cstr_to_cord(Untaint_lang l break; // never } #ifdef LATER - if(to_lang & UL_OPTIMIZE_BIT) { + if(to_lang & L_OPTIMIZE_BIT) { // optimizing whitespace char *stop=dest; dest=start; for(char c=start; src