--- parser3/src/main/untaint.C 2004/01/22 08:28:20 1.122.2.2 +++ parser3/src/main/untaint.C 2004/05/26 08:21:56 1.132 @@ -1,11 +1,11 @@ /** @file Parser: String class part: untaint mechanizm. - Copyright(c) 2001-2003 ArtLebedev Group (http://www.artlebedev.com) + Copyright(c) 2001-2004 ArtLebedev Group (http://www.artlebedev.com) Author: Alexandr Petrosian (http://paf.design.ru) */ -static const char* IDENT_UNTAINT_C="$Date: 2004/01/22 08:28:20 $"; +static const char * const IDENT_UNTAINT_C="$Date: 2004/05/26 08:21:56 $"; #include "pa_string.h" @@ -23,15 +23,10 @@ extern "C" { // author forgot to do that #include "ec.h" } -#define PA_SQL - -#ifdef PA_SQL #include "pa_sql_connection.h" -#endif // defines - #undef CORD_ec_append // redefining to intercept flushes and implement whitespace optimization // of all consequent white space chars leaving only first one @@ -39,7 +34,7 @@ extern "C" { // author forgot to do that { \ bool skip=false; \ if(optimize) switch(c) { \ - case ' ': case '\r': case '\n': case '\t': \ + case ' ': case '\n': case '\t': \ if(whitespace) \ skip=true; /*skipping subsequent*/ \ else \ @@ -98,35 +93,9 @@ inline bool need_http_header_encode(unsi return need_uri_encode(c); } -// - -static const char* String_Untaint_lang_name[]={ - "U", ///< zero value handy for hash lookup @see untaint_lang_name2enum - "C", ///< clean - "T", ///< tainted, untaint language as assigned later - // untaint languages. assigned by ^untaint[lang]{...} - "P", - /**< - leave language built into string being appended. - just a flag, that value not stored - */ - "A", ///< leave all characters intact - "F", ///< file specification - "H", ///< ext in HTTP response header - "M", ///< text in mail header - "URI", ///< text in uri - "T", ///< ^table:set body - "SQL", ///< ^table:sql body - "JS", ///< JavaScript code - "XML", ///< ^dom:set xml - "HTML" ///< HTML code (for editing) -}; - - // String /* - HTTP-header = field-name ":" [ field-value ] CRLF field-name = token @@ -268,7 +237,7 @@ inline bool mail_header_char_valid_withi || strchr("!*+-/", c); } inline bool addr_spec_soon(const char *src) { - for(char c; c=*src; src++) + for(char c; (c=*src); src++) if(c=='<') return true; else if(!(c==' ' || c=='\t')) @@ -284,6 +253,7 @@ inline bool addr_spec_soon(const char *s inline bool mail_header_nonspace_char(char c) { return c != 0x20; } + inline void ec_append(CORD_ec& result, bool& optimize, bool& whitespace, CORD_pos pos, size_t size) { while(size--) { CORD_ec_append(result, CORD_pos_fetch(pos)); @@ -292,12 +262,12 @@ inline void ec_append(CORD_ec& result, b } inline void pa_CORD_pos_advance(CORD_pos pos, size_t n) { while(true) { - size_t avail=CORD_pos_chars_left(pos); - if(avail==0) { + long avail=CORD_pos_chars_left(pos); + if(avail<=0) { CORD_next(pos); if(!--n) break; - } else if(avail=n @@ -373,7 +343,7 @@ int cstr_to_string_body_block(char alang info->charsets->client()); char c; - for(const char* src=output.str; c=*src++; ) + for(const char* src=output.str; (c=*src++); ) encode(need_uri_encode, '%', c); } break; @@ -400,13 +370,13 @@ int cstr_to_string_body_block(char alang bool email=false; uchar c; - for(const char* src=mail_ptr; c=(uchar)*src++; ) { - //RFC + An 'encoded-word' MUST NOT appear in any portion of an 'addr-spec'. - if(to_quoted_printable && (c==',' || addr_spec_soon(src) || c == '"')) { + for(const char* src=mail_ptr; (c=(uchar)*src++); ) { + if(to_quoted_printable && (c==',' || c == '"' || addr_spec_soon(src-1/*position to 'c'*/))) { email=c=='<'; to_string("?="); to_quoted_printable=false; } + //RFC + An 'encoded-word' MUST NOT appear in any portion of an 'addr-spec'. if(!email && ( !to_quoted_printable && (c & 0x80) // starting quote-printable-encoding on first 8bit char || to_quoted_printable && !mail_header_char_valid_within_Qencoded(c) @@ -429,15 +399,6 @@ int cstr_to_string_body_block(char alang } else ec_append(info->result, optimize, whitespace, info->pos, fragment_length); break; - case String::L_TABLE: - // tainted, untaint language: table - escape(switch(c) { - case '\t': to_char(' '); break; - case '\n': to_char(' '); break; - _default; - }); - break; -#ifdef PA_SQL case String::L_SQL: // tainted, untaint language: sql if(info->connection) { @@ -451,7 +412,6 @@ int cstr_to_string_body_block(char alang 0, "untaint in SQL language failed - no connection specified"); break; -#endif case String::L_JS: escape(switch(c) { case '"': to_string("\\\""); break; @@ -482,8 +442,7 @@ int cstr_to_string_body_block(char alang }); break; default: - assert(!"should never"); - SAPI::die("unknown untaint language #%d", + SAPI::abort("unknown untaint language #%d", static_cast(to_lang)); // should never break; // never }