escape.c 6.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. /* Escape and unescape URL encoding in strings. The functions return a new
  25. * allocated string or NULL if an error occurred. */
  26. #include "curl_setup.h"
  27. #include <curl/curl.h>
  28. #include "urldata.h"
  29. #include "warnless.h"
  30. #include "escape.h"
  31. #include "strdup.h"
  32. /* The last 3 #include files should be in this order */
  33. #include "curl_printf.h"
  34. #include "curl_memory.h"
  35. #include "memdebug.h"
  36. /* Portable character check (remember EBCDIC). Do not use isalnum() because
  37. its behavior is altered by the current locale.
  38. See https://datatracker.ietf.org/doc/html/rfc3986#section-2.3
  39. */
  40. bool Curl_isunreserved(unsigned char in)
  41. {
  42. switch(in) {
  43. case '0': case '1': case '2': case '3': case '4':
  44. case '5': case '6': case '7': case '8': case '9':
  45. case 'a': case 'b': case 'c': case 'd': case 'e':
  46. case 'f': case 'g': case 'h': case 'i': case 'j':
  47. case 'k': case 'l': case 'm': case 'n': case 'o':
  48. case 'p': case 'q': case 'r': case 's': case 't':
  49. case 'u': case 'v': case 'w': case 'x': case 'y': case 'z':
  50. case 'A': case 'B': case 'C': case 'D': case 'E':
  51. case 'F': case 'G': case 'H': case 'I': case 'J':
  52. case 'K': case 'L': case 'M': case 'N': case 'O':
  53. case 'P': case 'Q': case 'R': case 'S': case 'T':
  54. case 'U': case 'V': case 'W': case 'X': case 'Y': case 'Z':
  55. case '-': case '.': case '_': case '~':
  56. return TRUE;
  57. default:
  58. break;
  59. }
  60. return FALSE;
  61. }
  62. /* for ABI-compatibility with previous versions */
  63. char *curl_escape(const char *string, int inlength)
  64. {
  65. return curl_easy_escape(NULL, string, inlength);
  66. }
  67. /* for ABI-compatibility with previous versions */
  68. char *curl_unescape(const char *string, int length)
  69. {
  70. return curl_easy_unescape(NULL, string, length, NULL);
  71. }
  72. /* Escapes for URL the given unescaped string of given length.
  73. * 'data' is ignored since 7.82.0.
  74. */
  75. char *curl_easy_escape(struct Curl_easy *data, const char *string,
  76. int inlength)
  77. {
  78. size_t length;
  79. struct dynbuf d;
  80. (void)data;
  81. if(inlength < 0)
  82. return NULL;
  83. Curl_dyn_init(&d, CURL_MAX_INPUT_LENGTH * 3);
  84. length = (inlength?(size_t)inlength:strlen(string));
  85. if(!length)
  86. return strdup("");
  87. while(length--) {
  88. unsigned char in = *string; /* we need to treat the characters unsigned */
  89. if(Curl_isunreserved(in)) {
  90. /* append this */
  91. if(Curl_dyn_addn(&d, &in, 1))
  92. return NULL;
  93. }
  94. else {
  95. /* encode it */
  96. if(Curl_dyn_addf(&d, "%%%02X", in))
  97. return NULL;
  98. }
  99. string++;
  100. }
  101. return Curl_dyn_ptr(&d);
  102. }
  103. /*
  104. * Curl_urldecode() URL decodes the given string.
  105. *
  106. * Returns a pointer to a malloced string in *ostring with length given in
  107. * *olen. If length == 0, the length is assumed to be strlen(string).
  108. *
  109. * ctrl options:
  110. * - REJECT_NADA: accept everything
  111. * - REJECT_CTRL: rejects control characters (byte codes lower than 32) in
  112. * the data
  113. * - REJECT_ZERO: rejects decoded zero bytes
  114. *
  115. * The values for the enum starts at 2, to make the assert detect legacy
  116. * invokes that used TRUE/FALSE (0 and 1).
  117. */
  118. CURLcode Curl_urldecode(const char *string, size_t length,
  119. char **ostring, size_t *olen,
  120. enum urlreject ctrl)
  121. {
  122. size_t alloc;
  123. char *ns;
  124. size_t strindex = 0;
  125. unsigned long hex;
  126. DEBUGASSERT(string);
  127. DEBUGASSERT(ctrl >= REJECT_NADA); /* crash on TRUE/FALSE */
  128. alloc = (length?length:strlen(string)) + 1;
  129. ns = malloc(alloc);
  130. if(!ns)
  131. return CURLE_OUT_OF_MEMORY;
  132. while(--alloc > 0) {
  133. unsigned char in = *string;
  134. if(('%' == in) && (alloc > 2) &&
  135. ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
  136. /* this is two hexadecimal digits following a '%' */
  137. char hexstr[3];
  138. char *ptr;
  139. hexstr[0] = string[1];
  140. hexstr[1] = string[2];
  141. hexstr[2] = 0;
  142. hex = strtoul(hexstr, &ptr, 16);
  143. in = curlx_ultouc(hex); /* this long is never bigger than 255 anyway */
  144. string += 2;
  145. alloc -= 2;
  146. }
  147. if(((ctrl == REJECT_CTRL) && (in < 0x20)) ||
  148. ((ctrl == REJECT_ZERO) && (in == 0))) {
  149. free(ns);
  150. return CURLE_URL_MALFORMAT;
  151. }
  152. ns[strindex++] = in;
  153. string++;
  154. }
  155. ns[strindex] = 0; /* terminate it */
  156. if(olen)
  157. /* store output size */
  158. *olen = strindex;
  159. /* store output string */
  160. *ostring = ns;
  161. return CURLE_OK;
  162. }
  163. /*
  164. * Unescapes the given URL escaped string of given length. Returns a
  165. * pointer to a malloced string with length given in *olen.
  166. * If length == 0, the length is assumed to be strlen(string).
  167. * If olen == NULL, no output length is stored.
  168. * 'data' is ignored since 7.82.0.
  169. */
  170. char *curl_easy_unescape(struct Curl_easy *data, const char *string,
  171. int length, int *olen)
  172. {
  173. char *str = NULL;
  174. (void)data;
  175. if(length >= 0) {
  176. size_t inputlen = (size_t)length;
  177. size_t outputlen;
  178. CURLcode res = Curl_urldecode(string, inputlen, &str, &outputlen,
  179. REJECT_NADA);
  180. if(res)
  181. return NULL;
  182. if(olen) {
  183. if(outputlen <= (size_t) INT_MAX)
  184. *olen = curlx_uztosi(outputlen);
  185. else
  186. /* too large to return in an int, fail! */
  187. Curl_safefree(str);
  188. }
  189. }
  190. return str;
  191. }
  192. /* For operating systems/environments that use different malloc/free
  193. systems for the app and for this library, we provide a free that uses
  194. the library's memory system */
  195. void curl_free(void *p)
  196. {
  197. free(p);
  198. }