Author: rmeggins
Update of /cvs/dirsec/adminutil/lib/libadminutil
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv2494/adminutil/lib/libadminutil
Modified Files:
form_post.c
Log Message:
Resolves: bug 245248
Description: dsgw doesn't escape filename in error message
Reviewed by: nhosoi (Thanks!)
Fix Description: Do 2 passes on the input form data. In the first pass,
convert hex escapes (%xx) to the actual char. In the second pass, if the
char is one of the characters we must escape, convert to the html escape
form (e.g. '&' to "&") then write to output string. This
way we can
catch cases where "%xx" evaluates to '&' for example.
Platforms tested: RHEL5 x86_64
Flag day: no
Doc: no
Index: form_post.c
===================================================================
RCS file: /cvs/dirsec/adminutil/lib/libadminutil/form_post.c,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- form_post.c 21 Jun 2007 22:32:24 -0000 1.8
+++ form_post.c 3 Mar 2008 17:59:45 -0000 1.9
@@ -140,6 +140,10 @@
}
for (x = 0, y = 0; x < l; x++, y++) {
+ /* first, do the url unescaping, if needed -
+ digit holds the candidate char to write
+ to the output string
+ */
if (('%' == str[x]) && (x < (l - 2))) {
++x;
digit = (str[x] >= 'A' ?
@@ -149,27 +153,31 @@
++x;
digit += (str[x] >= 'A' ?
((str[x] & 0xdf) - 'A') + 10 : (str[x] -
'0'));
-
- rstr[y] = digit;
} else if (str[x] == '+') {
- rstr[y] = ' ';
- } else if ('<' == str[x]) {
+ digit = ' ';
+ } else {
+ digit = str[x];
+ }
+
+ /* next, see if digit (the original or the unescaped char)
+ needs to be html encoded */
+ if ('<' == digit) {
memcpy(&rstr[y], "<", 4);
y += 3;
- } else if ('>' == str[x]) {
+ } else if ('>' == digit) {
memcpy(&rstr[y], ">", 4);
y += 3;
- } else if ('&' == str[x]) {
+ } else if ('&' == digit) {
memcpy(&rstr[y], "&", 5);
y += 4;
- } else if ('"' == str[x]) {
+ } else if ('"' == digit) {
memcpy(&rstr[y], """, 6);
y += 5;
- } else if ('\'' == str[x]) {
+ } else if ('\'' == digit) {
memcpy(&rstr[y], "'", 5);
y += 4;
- } else {
- rstr[y] = str[x];
+ } else { /* just write the char to the output string */
+ rstr[y] = digit;
}
}
rstr[y] = '\0';
@@ -327,7 +335,7 @@
char *ans = NULL;
char buf[BUFSIZ];
- while(input[x]) {
+ while(input && input[x]) {
/* We want to get rid of the =, so len, len+1 */
if((!strncmp(input[x], varname, len)) && (*(input[x]+len) ==
'=')) {
if (!(ans = PL_strdup(input[x] + len + 1))) {
Show replies by date