--- parser3/src/main/untaint.C 2003/11/20 17:15:12 1.124 +++ parser3/src/main/untaint.C 2023/09/26 20:49:10 1.177 @@ -1,11 +1,11 @@ /** @file Parser: String class part: untaint mechanizm. - Copyright(c) 2001-2003 ArtLebedev Group (http://www.artlebedev.com) - Author: Alexandr Petrosian (http://paf.design.ru) + Copyright (c) 2001-2023 Art. Lebedev Studio (http://www.artlebedev.com) + Authors: Konstantin Morshnev , Alexandr Petrosian */ -static const char * const IDENT_UNTAINT_C="$Date: 2003/11/20 17:15:12 $"; +volatile const char * IDENT_UNTAINT_C="$Id: untaint.C,v 1.177 2023/09/26 20:49:10 moko Exp $"; #include "pa_string.h" @@ -20,18 +20,13 @@ static const char * const IDENT_UNTAINT_ #include "pa_sapi.h" extern "C" { // author forgot to do that -#include "ec.h" +#include "../lib/cord/include/ec.h" } -#define PA_SQL - -#ifdef PA_SQL #include "pa_sql_connection.h" -#endif // defines - #undef CORD_ec_append // redefining to intercept flushes and implement whitespace optimization // of all consequent white space chars leaving only first one @@ -39,7 +34,7 @@ extern "C" { // author forgot to do that { \ bool skip=false; \ if(optimize) switch(c) { \ - case ' ': case '\r': case '\n': case '\t': \ + case ' ': case '\n': case '\t': \ if(whitespace) \ skip=true; /*skipping subsequent*/ \ else \ @@ -57,45 +52,50 @@ extern "C" { // author forgot to do that } \ } - -#define escape(action) \ +#define escape_fragment(action) \ for(; fragment_length--; CORD_next(info->pos)) { \ char c=CORD_pos_fetch(info->pos); \ action \ } -#define _default default: CORD_ec_append(info->result, c); break + #define encode(need_encode_func, prefix, otherwise) \ if(need_encode_func(c)) { \ - static const char* hex="0123456789ABCDEF"; \ CORD_ec_append(info->result, prefix); \ - CORD_ec_append(info->result, hex[((unsigned char)c)/0x10]); \ - CORD_ec_append(info->result, hex[((unsigned char)c)%0x10]); \ + to_hex(c); \ } else \ CORD_ec_append(info->result, otherwise); -#define to_char(c) CORD_ec_append(info->result, c) -#define to_string(s) CORD_ec_append_cord(info->result, s) + +#define to_hex(c) \ + { \ + CORD_ec_append(info->result, hex_digits[((unsigned char)c) >> 4]); \ + CORD_ec_append(info->result, hex_digits[((unsigned char)c) & 0x0F]); \ + } + +#define to_char(c) { CORD_ec_append(info->result, c); whitespace=false; } +#define to_string(s) { CORD_ec_append_cord(info->result, (CORD)(s)); whitespace=false; } +#define _default CORD_ec_append(info->result, c) inline bool need_file_encode(unsigned char c){ // russian letters and space ENABLED // encoding only these... return strchr( - "*?'\"<>|" + "*?\"<>|" #ifndef WIN32 - ":\\" + ":\\" #endif - , c)!=0; + , c)!=0; } + inline bool need_uri_encode(unsigned char c){ - if((c>='0') &&(c<='9') ||(c>='A') &&(c<='Z') ||(c>='a') &&(c<='z')) - return false; + return !(pa_isalnum(c) || strchr("_-./*", c)); +} - return !strchr("_-./", c); +inline bool need_regex_escape(unsigned char c){ + return strchr("\\^$.[]|()?*+{}-", c)!=0; } -inline bool need_http_header_encode(unsigned char c){ - if(strchr(" , :", c)) - return false; - return need_uri_encode(c); +inline bool need_parser_code_escape(unsigned char c){ + return strchr("^$;@()[]{}:#\"", c)!=0; } // String @@ -103,34 +103,35 @@ inline bool need_http_header_encode(unsi /* HTTP-header = field-name ":" [ field-value ] CRLF - field-name = token - field-value = *( field-content | LWS ) +field-name = token +field-value = *( field-content | LWS ) - field-content = - -word = token | quoted-string - token = 1* +word = token | quoted-string +quoted-string = ( <"> *(qdtext | quoted-pair ) <"> ) +qdtext = > +quoted-pair = "\" CHAR - +OCTET = +CHAR = tspecials = "(" | ")" | "<" | ">" | "@" - | "," | ";" | ":" | "\" | <"> - | "/" | "[" | "]" | "?" | "=" - | "{" | "}" | SP | HT + | "," | ";" | ":" | "\" | <"> + | "/" | "[" | "]" | "?" | "=" + | "{" | "}" | SP | HT SP = HT = LWS = [CRLF] 1*( SP | HT ) -TEXT = +TEXT = +CTL = -quoted-pair = "\" CHAR if(strchr("()<>@,;:\\\"/[]?={} \t", *ptr)) */ @@ -178,27 +179,60 @@ int append_fragment_nonoptimizing(char a return 0; // 0=continue } + +/** + appends to other String without language change +*/ + +String& String::append_to(String& dest) const { + if(is_empty()) + return dest; + + // first: fragment infos + dest.langs.appendHelper(dest.body, langs, body); + + // next: letters + dest.body<='A' && c<='Z' - || c>='a' && c<='Z' - || c>='0' && c<='9' - || strchr("!*+-/", c); + return (pa_isalnum((unsigned char)c) || strchr("!*+-/", c)); } inline bool addr_spec_soon(const char *src) { for(char c; (c=*src); src++) @@ -258,6 +289,7 @@ inline bool addr_spec_soon(const char *s inline bool mail_header_nonspace_char(char c) { return c != 0x20; } + inline void ec_append(CORD_ec& result, bool& optimize, bool& whitespace, CORD_pos pos, size_t size) { while(size--) { CORD_ec_append(result, CORD_pos_fetch(pos)); @@ -266,12 +298,12 @@ inline void ec_append(CORD_ec& result, b } inline void pa_CORD_pos_advance(CORD_pos pos, size_t n) { while(true) { - size_t avail=CORD_pos_chars_left(pos); - if(avail==0) { + long avail=CORD_pos_chars_left(pos); + if(avail<=0) { CORD_next(pos); if(!--n) break; - } else if(avail=n @@ -296,16 +328,16 @@ struct Cstr_to_string_body_block_info { CORD_pos pos; size_t fragment_begin; bool whitespace; + const char* exception; }; #endif -int cstr_to_string_body_block(char alang, size_t fragment_length, Cstr_to_string_body_block_info* info) { - const String::Language fragment_lang=(String::Language)(unsigned char)alang; + +// @todo: replace info->body->mid with something that uses info->pos +int cstr_to_string_body_block(String::Language to_lang, size_t fragment_length, Cstr_to_string_body_block_info* info) { bool& whitespace=info->whitespace; size_t fragment_end=info->fragment_begin+fragment_length; - //fprintf(stderr, "%d, %d\n", fragment.lang, fragment.length); - + //fprintf(stderr, "%d, %d =%s=\n", to_lang, fragment_length, info->body->cstr()); - String::Language to_lang=info->lang==String::L_UNSPECIFIED?fragment_lang:info->lang; bool optimize=(to_lang & String::L_OPTIMIZE_BIT)!=0; if(!optimize) whitespace=false; @@ -325,14 +357,11 @@ int cstr_to_string_body_block(char alang break; case String::L_FILE_SPEC: // tainted, untaint language: file [name] - escape( - // Macintosh has problems with small Russian letter 'r' - if( c=='\xF0' && info->charsets && info->charsets->source().NAME()=="WINDOWS-1251" ) { - // fixing that letter for most common charset - to_char('p'); - } else // fallback to default + { + escape_fragment( encode(need_file_encode, '_', c); - ); + ); + } break; case String::L_URI: // tainted, untaint language: uri @@ -341,21 +370,21 @@ int cstr_to_string_body_block(char alang // skip source [we use recoded version] pa_CORD_pos_advance(info->pos, fragment_length); String::C output(fragment_str, fragment_length); - if(info->charsets) - output=Charset::transcode(output, - info->charsets->source(), - info->charsets->client()); + if(info->charsets) + output=Charset::transcode(output, info->charsets->source(), info->charsets->client()); char c; - for(const char* src=output.str; (c=*src++); ) + for(const char* src=output.str; (c=*src++); ) encode(need_uri_encode, '%', c); } break; case String::L_HTTP_HEADER: // tainted, untaint language: http-field-content-text - escape( - encode(need_uri_encode, '%', c); - ); + escape_fragment(switch(c) { + case '\n': + case '\r': to_string(" "); break; + default: _default; break; + }); break; case String::L_MAIL_HEADER: // tainted, untaint language: mail-header @@ -374,16 +403,18 @@ int cstr_to_string_body_block(char alang bool email=false; uchar c; - for(const char* src=mail_ptr; (c=(uchar)*src++); ) { - //RFC + An 'encoded-word' MUST NOT appear in any portion of an 'addr-spec'. - if(to_quoted_printable && (c==',' || addr_spec_soon(src) || c == '"')) { + for(const char* src=mail_ptr; c=(uchar)*src; src++) { + if(c=='\r' || c=='\n') + c=' '; + if(to_quoted_printable && (c==',' || c == '"' || addr_spec_soon(src))) { email=c=='<'; to_string("?="); to_quoted_printable=false; } + //RFC + An 'encoded-word' MUST NOT appear in any portion of an 'addr-spec'. if(!email && ( - !to_quoted_printable && (c & 0x80) // starting quote-printable-encoding on first 8bit char - || to_quoted_printable && !mail_header_char_valid_within_Qencoded(c) + ( !to_quoted_printable && (c & 0x80 || (c == ' ' && src == mail_ptr) ) ) // starting quote-printable-encoding on first 8bit char or leading space (issue #123) + || ( to_quoted_printable && !mail_header_char_valid_within_Qencoded(c) ) )) { if(!to_quoted_printable) { to_string("=?"); @@ -403,15 +434,6 @@ int cstr_to_string_body_block(char alang } else ec_append(info->result, optimize, whitespace, info->pos, fragment_length); break; - case String::L_TABLE: - // tainted, untaint language: table - escape(switch(c) { - case '\t': to_char(' '); break; - case '\n': to_char(' '); break; - _default; - }); - break; -#ifdef PA_SQL case String::L_SQL: // tainted, untaint language: sql if(info->connection) { @@ -420,45 +442,144 @@ int cstr_to_string_body_block(char alang pa_CORD_pos_advance(info->pos, fragment_length); to_string(info->connection->quote(fragment_str, fragment_length)); - } else - throw Exception(0, - 0, - "untaint in SQL language failed - no connection specified"); + } else { + info->exception="untaint in SQL language failed - no connection specified"; + info->fragment_begin=fragment_end; + return 1; // stop processing. can't throw exception here + } break; -#endif case String::L_JS: - escape(switch(c) { + escape_fragment(switch(c) { + case '\n': to_string("\\n"); break; case '"': to_string("\\\""); break; case '\'': to_string("\\'"); break; - case '\n': to_string("\\n"); break; case '\\': to_string("\\\\"); break; case '\xFF': to_string("\\\xFF"); break; - _default; + case '\r': to_string("\\r"); break; + default: _default; break; }); break; case String::L_XML: - escape(switch(c) { + // [2] Char ::= #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF] + escape_fragment(switch(c) { + case '\x20': + case '\x9': + case '\xA': + case '\xD': // this is usually removed on input + _default; + break; case '&': to_string("&"); break; case '>': to_string(">"); break; case '<': to_string("<"); break; case '"': to_string("""); break; case '\'': to_string("'"); break; - _default; + default: + if(((unsigned char)c)<0x20) { + // fixing it, so that libxml would not result + // in fatal error parsing text + // though it really violates standard. + // to indicate there were an error + // replace bad char not to it's code, + // which we can do, + // but rather to '!' to show that input were actually + // invalid. + // life: shows that MSIE can somehow garble form values + // so that they contain these chars. + to_char('!'); + } else { + _default; + } + break; }); break; case String::L_HTML: - escape(switch(c) { + escape_fragment(switch(c) { case '&': to_string("&"); break; case '>': to_string(">"); break; case '<': to_string("<"); break; case '"': to_string("""); break; - _default; + default: _default; break; }); break; + case String::L_REGEX: + // tainted, untaint language: regex + escape_fragment( + if(need_regex_escape(c)) + to_char('\\') + _default; + ); + break; + case String::L_JSON: + // tainted, untaint language: json + // escape '"' '\' '/' '\n' '\t' '\r' '\b' '\f' chars and escape chars as \uXXXX if output charset != UTF-8 + { + if(info->charsets==NULL || info->charsets->client().isUTF8()){ + // escaping to \uXXXX is not needed + escape_fragment(switch((unsigned char)c) { + case '\n': to_string("\\n"); break; + case '"' : to_string("\\\""); break; + case '\\': to_string("\\\\"); break; + case '/' : to_string("\\/"); break; + case '\t': to_string("\\t"); break; + case '\r': to_string("\\r"); break; + case '\b': to_string("\\b"); break; + case '\f': to_string("\\f"); break; + case 0xE2: // \u2028 and \u2029 (line/paragraph separators), check bug #1023 + if(info->charsets && info->charsets->source().isUTF8() && fragment_length>=2){ + CORD_next(info->pos); + char c1=CORD_pos_fetch(info->pos); + CORD_next(info->pos); + char c2=CORD_pos_fetch(info->pos); + if((unsigned char)c1 == 0x80 && ((unsigned char)c2 >= 0xA8 && (unsigned char)c2 <= 0xAF)){ + to_string("\\u20"); + to_hex(((unsigned char)c2-0x80)); + } else { + CORD_ec_append(info->result, c); + CORD_ec_append(info->result, c1); + CORD_ec_append(info->result, c2); + } + fragment_length-=2; + } else { + _default; + } + break; + default: + if((unsigned char)c < 0x20){ + to_string("\\u00"); + to_hex(c); + } else { + _default; + } + break; + }); + } else { + const char *fragment_str=info->body->mid(info->fragment_begin, fragment_length).cstr(); + // skip source [we use recoded version] + pa_CORD_pos_advance(info->pos, fragment_length); + to_string(Charset::escape_JSON(String::C(fragment_str, fragment_length), info->charsets->source()).str); + } + } + break; + case String::L_HTTP_COOKIE: + // tainted, untaint language: cookie (3.3.0 and higher: %uXXXX in UTF-8) + if(info->charsets) { + const char *fragment_str=info->body->mid(info->fragment_begin, fragment_length).cstr(); + // skip source [we use recoded version] + pa_CORD_pos_advance(info->pos, fragment_length); + to_string(Charset::escape(String::C(fragment_str, fragment_length), info->charsets->source()).str); + } else + ec_append(info->result, optimize, whitespace, info->pos, fragment_length); + break; + case String::L_PARSER_CODE: + // for auto-untaint in process + escape_fragment( + if(need_parser_code_escape(c)) + to_char('^'); + _default; + ); + break; default: - assert(!"should never"); - SAPI::die("unknown untaint language #%d", - static_cast(to_lang)); // should never + SAPI::die("unknown untaint language #%d", static_cast(to_lang)); // should never break; // never } @@ -468,9 +589,9 @@ int cstr_to_string_body_block(char alang } -String::Body String::cstr_to_string_body(Language lang, - SQL_Connection* connection, - const Request_charsets *charsets) const { +String::Body String::cstr_to_string_body_taint(Language lang, SQL_Connection* connection, const Request_charsets *charsets) const { + if(is_empty()) + return String::Body(); Cstr_to_string_body_block_info info; // input @@ -483,10 +604,66 @@ String::Body String::cstr_to_string_body // private body.set_pos(info.pos, 0); info.fragment_begin=0; + info.exception=0; info.whitespace=true; - if(!is_empty()) - langs.for_each(body, cstr_to_string_body_block, &info); + cstr_to_string_body_block(lang, length(), &info); + + if(info.exception) + throw Exception(0, + 0, + info.exception); return String::Body(CORD_ec_to_cord(info.result)); } + +int cstr_to_string_body_block_untaint(char alang, size_t fragment_length, Cstr_to_string_body_block_info* info){ + const String::Language lang=(String::Language)(unsigned char)alang; + // see append_fragment_* for explanation + if(info->lang&String::L_OPTIMIZE_BIT) + return cstr_to_string_body_block( + lang==String::L_TAINTED? + info->lang + :lang==String::L_CLEAN? + (String::Language)(String::L_CLEAN|String::L_OPTIMIZE_BIT) + :lang, + fragment_length, info); + else + return cstr_to_string_body_block(lang==String::L_TAINTED ? info->lang:lang, fragment_length, info); +} + +String::Body String::cstr_to_string_body_untaint(Language lang, SQL_Connection* connection, const Request_charsets *charsets) const { + if(is_empty()) + return String::Body(); + + Cstr_to_string_body_block_info info; + // input + info.lang=lang; + info.connection=connection; + info.charsets=charsets; + info.body=&body; + // output + CORD_ec_init(info.result); + // private + body.set_pos(info.pos, 0); + info.fragment_begin=0; + info.exception=0; + info.whitespace=true; + + langs.for_each(body, cstr_to_string_body_block_untaint, &info); + + if(info.exception) + throw Exception(0, + 0, + info.exception); + + return String::Body(CORD_ec_to_cord(info.result)); +} + +const char* String::untaint_and_transcode_cstr(Language lang, const Request_charsets *charsets) const { + if(charsets && &charsets->source() != &charsets->client()){ + // Note: L_URI is allready transcoded during untaint, but transcode does not affect %XX + return Charset::transcode(cstr_to_string_body_untaint(lang, 0, charsets), charsets->source(), charsets->client()).cstr(); + } else + return cstr_to_string_body_untaint(lang, 0, charsets).cstr(); +}