# ------------------------------------------------------------------------------ # CHANGES | 5 +++ # WWW/Library/Implementation/HTParse.c | 48 +++++++++++++++++++++++++++++---- # WWW/Library/Implementation/HTParse.h | 21 +++++++++++--- # src/LYMain.c | 8 ++--- # src/LYMainLoop.c | 12 ++------ # src/LYStrings.c | 24 ++++++++++++++++ # src/LYStrings.h | 4 ++ # 7 files changed, 100 insertions(+), 22 deletions(-) # ------------------------------------------------------------------------------ Index: CHANGES --- lynx2.8.4rel.1b+/CHANGES Sun Aug 18 13:35:37 2002 +++ lynx2.8.4rel.1c/CHANGES Sun Aug 18 13:56:07 2002 @@ -1,6 +1,11 @@ Changes since Lynx 2.8 release =============================================================================== +extracted from 2002-08-14 (2.8.5dev.9) +* escape blanks and other non-7bit graphic characters in startfile and similar + addresses to guard against interpreting the address as multiple lines + during a GET, etc (report by Ulf Harnhammar ) -TD + extracted from 2001-10-06 (2.8.5dev.3) * modify LYtouchline() to avoid using wredrawln() for ncurses, since the LYwin variable may be a pad much wider than the screen, which is not handled Index: WWW/Library/Implementation/HTParse.c --- lynx2.8.4rel.1b+/WWW/Library/Implementation/HTParse.c Sun Apr 1 21:02:30 2001 +++ lynx2.8.4rel.1c/WWW/Library/Implementation/HTParse.c Sun Aug 18 13:37:02 2002 @@ -696,8 +696,8 @@ return result; } -/* Escape undesirable characters using % HTEscape() -** ------------------------------------- +/* Escape undesirable characters using % HTEscape() +** ------------------------------------- ** ** This function takes a pointer to a string in which ** some characters may be unacceptable unescaped. @@ -710,7 +710,7 @@ /* Bit 0 xalpha -- see HTFile.h ** Bit 1 xpalpha -- as xalpha but with plus. -** Bit 3 ... path -- as xpalphas but with / +** Bit 2 ... path -- as xpalphas but with / */ /* 0 1 2 3 4 5 6 7 8 9 A B C D E F */ { 0,0,0,0,0,0,0,0,0,0,7,6,0,7,7,4, /* 2x !"#$%&'()*+,-./ */ @@ -740,13 +740,51 @@ for (q = result, p = str; *p; p++) { unsigned char a = TOASCII(*p); if (!ACCEPTABLE(a)) { - *q++ = HEX_ESCAPE; /* Means hex commming */ + *q++ = HEX_ESCAPE; /* Means hex coming */ *q++ = hex[a >> 4]; *q++ = hex[a & 15]; } else *q++ = *p; } - *q++ = '\0'; /* Terminate */ + *q++ = '\0'; /* Terminate */ + return result; +} + +/* Escape unsafe characters using % HTEscapeUnsafe() +** -------------------------------- +** +** This function takes a pointer to a string in which +** some characters may be that may be unsafe are unescaped. +** It returns a string which has these characters +** represented by a '%' character followed by two hex digits. +** +** Unlike HTUnEscape(), this routine returns a malloc'd string. +*/ +#define UNSAFE(ch) (((ch) <= 32) || ((ch) >= 127)) + +PUBLIC char *HTEscapeUnsafe ARGS1( + CONST char *, str) +{ + CONST char * p; + char * q; + char * result; + int unacceptable = 0; + for (p = str; *p; p++) + if (UNSAFE(UCH(TOASCII(*p)))) + unacceptable++; + result = typecallocn(char, p-str + unacceptable + unacceptable + 1); + if (result == NULL) + outofmem(__FILE__, "HTEscapeUnsafe"); + for (q = result, p = str; *p; p++) { + unsigned char a = TOASCII(*p); + if (UNSAFE(a)) { + *q++ = HEX_ESCAPE; /* Means hex coming */ + *q++ = hex[a >> 4]; + *q++ = hex[a & 15]; + } + else *q++ = *p; + } + *q++ = '\0'; /* Terminate */ return result; } Index: WWW/Library/Implementation/HTParse.h --- lynx2.8.4rel.1b+/WWW/Library/Implementation/HTParse.h Wed Oct 25 14:35:30 2000 +++ lynx2.8.4rel.1c/WWW/Library/Implementation/HTParse.h Sun Aug 18 13:37:02 2002 @@ -113,26 +113,39 @@ ** ------------------------------------- ** ** This function takes a pointer to a string in which -** some characters may be unacceptable unescaped. +** some characters may be unacceptable are unescaped. ** It returns a string which has these characters ** represented by a '%' character followed by two hex digits. ** -** Unlike HTUnEscape(), this routine returns a malloced string. +** Unlike HTUnEscape(), this routine returns a malloc'd string. */ extern char * HTEscape PARAMS(( CONST char * str, unsigned char mask)); +/* Escape unsafe characters using % HTEscapeUnsafe() +** -------------------------------- +** +** This function takes a pointer to a string in which +** some characters may be that may be unsafe are unescaped. +** It returns a string which has these characters +** represented by a '%' character followed by two hex digits. +** +** Unlike HTUnEscape(), this routine returns a malloc'd string. +*/ +extern char * HTEscapeUnsafe PARAMS(( + CONST char * str)); + /* Escape undesirable characters using % but space to +. HTEscapeSP() ** ----------------------------------------------------- ** ** This function takes a pointer to a string in which -** some characters may be unacceptable unescaped. +** some characters may be unacceptable are unescaped. ** It returns a string which has these characters ** represented by a '%' character followed by two hex digits, ** except that spaces are converted to '+' instead of %2B. ** -** Unlike HTUnEscape(), this routine returns a malloced string. +** Unlike HTUnEscape(), this routine returns a malloc'd string. */ extern char * HTEscapeSP PARAMS(( CONST char * str, Index: src/LYMain.c --- lynx2.8.4rel.1b+/src/LYMain.c Sun Aug 18 13:35:37 2002 +++ lynx2.8.4rel.1c/src/LYMain.c Sun Aug 18 13:37:02 2002 @@ -1047,7 +1047,7 @@ StrAllocCopy(helpfile, HELPFILE); StrAllocCopy(startfile, STARTFILE); - LYTrimStartfile(startfile); + LYEscapeStartfile(&startfile); StrAllocCopy(indexfile, DEFAULT_INDEX_FILE); StrAllocCopy(global_type_map, GLOBAL_MAILCAP); StrAllocCopy(personal_type_map, PERSONAL_MAILCAP); @@ -1509,7 +1509,7 @@ */ if ((cp = getenv("WWW_HOME")) != NULL) { StrAllocCopy(startfile, cp); - LYTrimStartfile(startfile); + LYEscapeStartfile(&startfile); } /* @@ -2652,7 +2652,7 @@ { if (next_arg != 0) { StrAllocCopy(homepage, next_arg); - LYTrimStartfile(homepage); + LYEscapeStartfile(&homepage); } return 0; } @@ -3952,7 +3952,7 @@ had_nonoption = TRUE; #endif StrAllocCopy(startfile, arg_name); - LYTrimStartfile(startfile); + LYEscapeStartfile(&startfile); #ifdef _WINDOWS /* 1998/01/14 (Wed) 20:11:17 */ HTUnEscape(startfile); { Index: src/LYMainLoop.c --- lynx2.8.4rel.1b+/src/LYMainLoop.c Sun Aug 18 13:35:32 2002 +++ lynx2.8.4rel.1c/src/LYMainLoop.c Sun Aug 18 13:37:02 2002 @@ -689,9 +689,7 @@ /* * Get rid of leading spaces (and any other spaces). */ - if (!LYTrimStartfile(user_input_buffer)) { - LYRemoveBlanks(user_input_buffer); - } + LYTrimAllStartfile(user_input_buffer); if (*user_input_buffer == '\0' && !(recall && (ch == UPARROW || ch == DNARROW))) { LYstrncpy(user_input_buffer, *old_user_input, MAX_LINE - 1); @@ -2394,9 +2392,7 @@ MAX_LINE, RECALL_URL)) >= 0) && user_input_buffer[0] != '\0' && strcmp(user_input_buffer, curdoc.address)) { - if (!LYTrimStartfile(user_input_buffer)) { - LYRemoveBlanks(user_input_buffer); - } + LYTrimAllStartfile(user_input_buffer); if (user_input_buffer[0] != '\0') { return 2; } @@ -2657,9 +2653,7 @@ ((links[curdoc.link].type == WWW_FORM_LINK_TYPE) ? links[curdoc.link].form->submit_action : links[curdoc.link].lname))) { - if (!LYTrimStartfile(user_input_buffer)) { - LYRemoveBlanks(user_input_buffer); - } + LYTrimAllStartfile(user_input_buffer); if (user_input_buffer[0] != '\0') { return 2; } Index: src/LYStrings.c --- lynx2.8.4rel.1b+/src/LYStrings.c Sun Aug 18 13:35:32 2002 +++ lynx2.8.4rel.1c/src/LYStrings.c Sun Aug 18 13:37:02 2002 @@ -2604,6 +2604,30 @@ } /* + * Escape unsafe characters in startfile, except for lynx internal URLs. + */ +PUBLIC void LYEscapeStartfile ARGS1( + char **, buffer) +{ + if (!LYTrimStartfile(*buffer)) { + char *escaped = HTEscapeUnsafe(*buffer); + StrAllocCopy(*buffer, escaped); + FREE(escaped); + } +} + +/* + * Trim all blanks from startfile, except for lynx internal URLs. + */ +PUBLIC void LYTrimAllStartfile ARGS1( + char *, buffer) +{ + if (!LYTrimStartfile(buffer)) { + LYRemoveBlanks(buffer); + } +} + +/* ** Display the current value of the string and allow the user ** to edit it. */ Index: src/LYStrings.h --- lynx2.8.4rel.1b+/src/LYStrings.h Sun Jun 3 17:17:35 2001 +++ lynx2.8.4rel.1c/src/LYStrings.h Sun Aug 18 13:37:02 2002 @@ -294,6 +294,8 @@ extern char *LYElideString PARAMS(( char * str, int cut_pos)); +extern void LYEscapeStartfile PARAMS(( + char ** buffer)); extern void LYLowerCase PARAMS(( char * buffer)); extern void LYUpperCase PARAMS(( @@ -311,6 +313,8 @@ extern void LYTrimLeading PARAMS(( char * buffer)); extern void LYTrimTrailing PARAMS(( + char * buffer)); +extern void LYTrimAllStartfile PARAMS(( char * buffer)); extern BOOLEAN LYTrimStartfile PARAMS(( char * buffer));