--- parser3/src/main/untaint.C	2010/08/27 02:53:24	1.156
+++ parser3/src/main/untaint.C	2011/02/18 06:03:53	1.162
@@ -5,7 +5,7 @@
 	Author: Alexandr Petrosian <paf@design.ru> (http://paf.design.ru)
 */
 
-static const char * const IDENT_UNTAINT_C="$Date: 2010/08/27 02:53:24 $";
+static const char * const IDENT_UNTAINT_C="$Date: 2011/02/18 06:03:53 $";
 
 
 #include "pa_string.h"
@@ -82,17 +82,7 @@ inline bool need_file_encode(unsigned ch
 }
 
 inline bool need_uri_encode(unsigned char c){
-	if((c>='0') && (c<='9') || (c>='A') && (c<='Z') || (c>='a') && (c<='z'))
-		return false;
-
-	return !strchr("_-./", c);
-}
-
-inline bool need_http_header_encode(unsigned char c){
-	if(strchr(" , :", c))
-		return false;
-
-	return need_uri_encode(c);
+	return !(pa_isalnum(c) || strchr("_-./*", c));
 }
 
 inline bool need_regex_escape(unsigned char c){
@@ -258,10 +248,7 @@ RFC
 		and without "_", or in would mean 0x20
 */
 inline bool mail_header_char_valid_within_Qencoded(char c) {
-	return c>='A' && c<='Z'
-		|| c>='a' && c<='Z'
-		|| c>='0' && c<='9'
-		|| strchr("!*+-/", c);
+	return (pa_isalnum((unsigned char)c) || strchr("!*+-/", c));
 }
 inline bool addr_spec_soon(const char *src) {
 	for(char c; (c=*src); src++)
@@ -354,15 +341,6 @@ int cstr_to_string_body_block(String::La
 			);
 		}
 		break;
-	case String::L_FILE_POST:
-		{
-			escape_fragment(switch(c) {
-				case '\0': to_string("\\0");  break;
-				case '\\': to_string("\\\\"); break;
-				default: _default; break;
-			});
-		}
-		break;
 	case String::L_URI:
 		// tainted, untaint language: uri	 
 		{	 
@@ -382,9 +360,11 @@ int cstr_to_string_body_block(String::La
 		break;
 	case String::L_HTTP_HEADER:
 		// tainted, untaint language: http-field-content-text
-		escape_fragment(
-			encode(need_uri_encode, '%', c);
-		);
+		escape_fragment(switch(c) {
+			case '\n': 
+			case '\r': to_string(" ");  break;
+			default: _default; break;
+		});
 		break;
 	case String::L_MAIL_HEADER:
 		// tainted, untaint language: mail-header
@@ -513,7 +493,7 @@ int cstr_to_string_body_block(String::La
 		// tainted, untaint language: json <http://json.org/>
 		// escape '"' '\' '/' '\n' '\t' '\r' '\b' '\f' chars and escape chars as \uXXXX if output charset != UTF-8
 		{
-			if(info->charsets->client().isUTF8()){
+			if(info->charsets==NULL || info->charsets->client().isUTF8()){
 				// escaping to \uXXXX is not needed
 				escape_fragment(switch(c) {
 					case '\n': to_string("\\n");  break;
@@ -539,17 +519,16 @@ int cstr_to_string_body_block(String::La
 		break;
 	case String::L_HTTP_COOKIE:
 		// tainted, untaint language: cookie (3.3.0 and higher: %uXXXX in UTF-8)
-		{
+		if(info->charsets) {
 			const char *fragment_str=info->body->mid(info->fragment_begin, fragment_length).cstr();
 			// skip source [we use recoded version]
 			pa_CORD_pos_advance(info->pos, fragment_length);
 			String::C output(fragment_str, fragment_length);
 			
 			output=Charset::escape(output, info->charsets->source());
-			//throw Exception(0, 0, output);
 			to_string(output);
-
-		}
+		} else
+			ec_append(info->result, optimize, whitespace, info->pos, fragment_length);
 		break;
 	case String::L_PARSER_CODE:
 		// for auto-untaint in process
@@ -596,7 +575,7 @@ String::Body String::cstr_to_string_body
 			0,
 			info.exception);
 
-	return String::Body(CORD_ec_to_cord(info.result), info.fragment_begin);
+	return String::Body(CORD_ec_to_cord(info.result));
 }
 
 int cstr_to_string_body_block_untaint(char alang, size_t fragment_length, Cstr_to_string_body_block_info* info){
@@ -639,7 +618,7 @@ String::Body String::cstr_to_string_body
 			0,
 			info.exception);
 
-	return String::Body(CORD_ec_to_cord(info.result), info.fragment_begin);
+	return String::Body(CORD_ec_to_cord(info.result));
 }
 
 const char* String::untaint_and_transcode_cstr(Language lang, const Request_charsets *charsets) const {