file: escape strings in HTML output

[project/uhttpd.git] / utils.c

diff --git a/utils.c b/utils.c
index 857e326e5e1793d6498b07aefe42837f68c8967b..d990d7dfd2bee38ac13db87ddffb452a14836e0f 100644 (file)
--- a/utils.c
+++ b/utils.c
@@ -32,12 +32,12 @@ bool uh_use_chunked(struct client *cl)
        if (cl->http_code == 204 || cl->http_code == 304)
                return false;
 
-       return true;
+       return !cl->request.disable_chunked;
 }
 
 void uh_chunk_write(struct client *cl, const void *data, int len)
 {
-       bool chunked = cl->request.respond_chunked;
+       bool chunked = uh_use_chunked(cl);
 
        if (cl->state == CLIENT_STATE_CLEANUP)
                return;
@@ -60,7 +60,7 @@ void uh_chunk_vprintf(struct client *cl, const char *format, va_list arg)
                return;
 
        uloop_timeout_set(&cl->timeout, conf.network_timeout * 1000);
-       if (!cl->request.respond_chunked) {
+       if (!uh_use_chunked(cl)) {
                ustream_vprintf(cl->us, format, arg);
                return;
        }
@@ -88,7 +88,7 @@ void uh_chunk_printf(struct client *cl, const char *format, ...)
 
 void uh_chunk_eof(struct client *cl)
 {
-       if (!cl->request.respond_chunked)
+       if (!uh_use_chunked(cl))
                return;
 
        if (cl->state == CLIENT_STATE_CLEANUP)
@@ -208,6 +208,10 @@ bool uh_path_match(const char *prefix, const char *url)
 {
        int len = strlen(prefix);
 
+       /* A prefix of "/" will - by definition - match any url */
+       if (prefix[0] == '/' && len == 1)
+               return true;
+
        if (strncmp(url, prefix, len) != 0)
                return false;
 
@@ -245,3 +249,45 @@ bool uh_addr_rfc1918(struct uh_addr *addr)
 
        return 0;
 }
+
+
+static bool is_html_special_char(char c)
+{
+       switch (c)
+       {
+       case 0x22:
+       case 0x26:
+       case 0x27:
+       case 0x3C:
+       case 0x3E:
+               return true;
+
+       default:
+               return false;
+       }
+}
+
+char *uh_htmlescape(const char *str)
+{
+       size_t i, len;
+       char *p, *copy;
+
+       for (i = 0, len = 1; str[i]; i++)
+               if (is_html_special_char(str[i]))
+                       len += 6; /* &#x??; */
+               else
+                       len++;
+
+       copy = calloc(1, len);
+
+       if (!copy)
+               return NULL;
+
+       for (i = 0, p = copy; str[i]; i++)
+               if (is_html_special_char(str[i]))
+                       p += sprintf(p, "&#x%02x;", (unsigned int)str[i]);
+               else
+                       *p++ = str[i];
+
+       return copy;
+}