2
0

escape.c 6.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. /* Escape and unescape URL encoding in strings. The functions return a new
  25. * allocated string or NULL if an error occurred. */
  26. #include "curl_setup.h"
  27. #include <curl/curl.h>
  28. #include "urldata.h"
  29. #include "warnless.h"
  30. #include "escape.h"
  31. #include "strdup.h"
  32. /* The last 3 #include files should be in this order */
  33. #include "curl_printf.h"
  34. #include "curl_memory.h"
  35. #include "memdebug.h"
  36. /* for ABI-compatibility with previous versions */
  37. char *curl_escape(const char *string, int inlength)
  38. {
  39. return curl_easy_escape(NULL, string, inlength);
  40. }
  41. /* for ABI-compatibility with previous versions */
  42. char *curl_unescape(const char *string, int length)
  43. {
  44. return curl_easy_unescape(NULL, string, length, NULL);
  45. }
  46. /* Escapes for URL the given unescaped string of given length.
  47. * 'data' is ignored since 7.82.0.
  48. */
  49. char *curl_easy_escape(struct Curl_easy *data, const char *string,
  50. int inlength)
  51. {
  52. size_t length;
  53. struct dynbuf d;
  54. (void)data;
  55. if(inlength < 0)
  56. return NULL;
  57. Curl_dyn_init(&d, CURL_MAX_INPUT_LENGTH * 3);
  58. length = (inlength?(size_t)inlength:strlen(string));
  59. if(!length)
  60. return strdup("");
  61. while(length--) {
  62. unsigned char in = *string++; /* treat the characters unsigned */
  63. if(ISUNRESERVED(in)) {
  64. /* append this */
  65. if(Curl_dyn_addn(&d, &in, 1))
  66. return NULL;
  67. }
  68. else {
  69. /* encode it */
  70. const char hex[] = "0123456789ABCDEF";
  71. char out[3]={'%'};
  72. out[1] = hex[in>>4];
  73. out[2] = hex[in & 0xf];
  74. if(Curl_dyn_addn(&d, out, 3))
  75. return NULL;
  76. }
  77. }
  78. return Curl_dyn_ptr(&d);
  79. }
  80. static const unsigned char hextable[] = {
  81. 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 0, 0, 0, 0, 0, /* 0x30 - 0x3f */
  82. 0, 10, 11, 12, 13, 14, 15, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x40 - 0x4f */
  83. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x50 - 0x5f */
  84. 0, 10, 11, 12, 13, 14, 15 /* 0x60 - 0x66 */
  85. };
  86. /* the input is a single hex digit */
  87. #define onehex2dec(x) hextable[x - '0']
  88. /*
  89. * Curl_urldecode() URL decodes the given string.
  90. *
  91. * Returns a pointer to a malloced string in *ostring with length given in
  92. * *olen. If length == 0, the length is assumed to be strlen(string).
  93. *
  94. * ctrl options:
  95. * - REJECT_NADA: accept everything
  96. * - REJECT_CTRL: rejects control characters (byte codes lower than 32) in
  97. * the data
  98. * - REJECT_ZERO: rejects decoded zero bytes
  99. *
  100. * The values for the enum starts at 2, to make the assert detect legacy
  101. * invokes that used TRUE/FALSE (0 and 1).
  102. */
  103. CURLcode Curl_urldecode(const char *string, size_t length,
  104. char **ostring, size_t *olen,
  105. enum urlreject ctrl)
  106. {
  107. size_t alloc;
  108. char *ns;
  109. DEBUGASSERT(string);
  110. DEBUGASSERT(ctrl >= REJECT_NADA); /* crash on TRUE/FALSE */
  111. alloc = (length?length:strlen(string));
  112. ns = malloc(alloc + 1);
  113. if(!ns)
  114. return CURLE_OUT_OF_MEMORY;
  115. /* store output string */
  116. *ostring = ns;
  117. while(alloc) {
  118. unsigned char in = *string;
  119. if(('%' == in) && (alloc > 2) &&
  120. ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
  121. /* this is two hexadecimal digits following a '%' */
  122. in = (unsigned char)(onehex2dec(string[1]) << 4) | onehex2dec(string[2]);
  123. string += 3;
  124. alloc -= 3;
  125. }
  126. else {
  127. string++;
  128. alloc--;
  129. }
  130. if(((ctrl == REJECT_CTRL) && (in < 0x20)) ||
  131. ((ctrl == REJECT_ZERO) && (in == 0))) {
  132. Curl_safefree(*ostring);
  133. return CURLE_URL_MALFORMAT;
  134. }
  135. *ns++ = in;
  136. }
  137. *ns = 0; /* terminate it */
  138. if(olen)
  139. /* store output size */
  140. *olen = ns - *ostring;
  141. return CURLE_OK;
  142. }
  143. /*
  144. * Unescapes the given URL escaped string of given length. Returns a
  145. * pointer to a malloced string with length given in *olen.
  146. * If length == 0, the length is assumed to be strlen(string).
  147. * If olen == NULL, no output length is stored.
  148. * 'data' is ignored since 7.82.0.
  149. */
  150. char *curl_easy_unescape(struct Curl_easy *data, const char *string,
  151. int length, int *olen)
  152. {
  153. char *str = NULL;
  154. (void)data;
  155. if(length >= 0) {
  156. size_t inputlen = (size_t)length;
  157. size_t outputlen;
  158. CURLcode res = Curl_urldecode(string, inputlen, &str, &outputlen,
  159. REJECT_NADA);
  160. if(res)
  161. return NULL;
  162. if(olen) {
  163. if(outputlen <= (size_t) INT_MAX)
  164. *olen = curlx_uztosi(outputlen);
  165. else
  166. /* too large to return in an int, fail! */
  167. Curl_safefree(str);
  168. }
  169. }
  170. return str;
  171. }
  172. /* For operating systems/environments that use different malloc/free
  173. systems for the app and for this library, we provide a free that uses
  174. the library's memory system */
  175. void curl_free(void *p)
  176. {
  177. free(p);
  178. }
  179. /*
  180. * Curl_hexencode()
  181. *
  182. * Converts binary input to lowercase hex-encoded ASCII output.
  183. * Null-terminated.
  184. */
  185. void Curl_hexencode(const unsigned char *src, size_t len, /* input length */
  186. unsigned char *out, size_t olen) /* output buffer size */
  187. {
  188. const char *hex = "0123456789abcdef";
  189. DEBUGASSERT(src && len && (olen >= 3));
  190. if(src && len && (olen >= 3)) {
  191. while(len-- && (olen >= 3)) {
  192. /* clang-tidy warns on this line without this comment: */
  193. /* NOLINTNEXTLINE(clang-analyzer-core.UndefinedBinaryOperatorResult) */
  194. *out++ = hex[(*src & 0xF0)>>4];
  195. *out++ = hex[*src & 0x0F];
  196. ++src;
  197. olen -= 2;
  198. }
  199. *out = 0;
  200. }
  201. else if(olen)
  202. *out = 0;
  203. }