/src/gdal/curl/lib/escape.c
Line | Count | Source (jump to first uncovered line) |
1 | | /*************************************************************************** |
2 | | * _ _ ____ _ |
3 | | * Project ___| | | | _ \| | |
4 | | * / __| | | | |_) | | |
5 | | * | (__| |_| | _ <| |___ |
6 | | * \___|\___/|_| \_\_____| |
7 | | * |
8 | | * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. |
9 | | * |
10 | | * This software is licensed as described in the file COPYING, which |
11 | | * you should have received as part of this distribution. The terms |
12 | | * are also available at https://curl.se/docs/copyright.html. |
13 | | * |
14 | | * You may opt to use, copy, modify, merge, publish, distribute and/or sell |
15 | | * copies of the Software, and permit persons to whom the Software is |
16 | | * furnished to do so, under the terms of the COPYING file. |
17 | | * |
18 | | * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY |
19 | | * KIND, either express or implied. |
20 | | * |
21 | | * SPDX-License-Identifier: curl |
22 | | * |
23 | | ***************************************************************************/ |
24 | | |
25 | | /* Escape and unescape URL encoding in strings. The functions return a new |
26 | | * allocated string or NULL if an error occurred. */ |
27 | | |
28 | | #include "curl_setup.h" |
29 | | |
30 | | #include <curl/curl.h> |
31 | | |
32 | | struct Curl_easy; |
33 | | |
34 | | #include "urldata.h" |
35 | | #include "curlx/warnless.h" |
36 | | #include "escape.h" |
37 | | #include "strdup.h" |
38 | | #include "curlx/strparse.h" |
39 | | |
40 | | /* The last 3 #include files should be in this order */ |
41 | | #include "curl_printf.h" |
42 | | #include "curl_memory.h" |
43 | | #include "memdebug.h" |
44 | | |
45 | | /* for ABI-compatibility with previous versions */ |
46 | | char *curl_escape(const char *string, int inlength) |
47 | 0 | { |
48 | 0 | return curl_easy_escape(NULL, string, inlength); |
49 | 0 | } |
50 | | |
51 | | /* for ABI-compatibility with previous versions */ |
52 | | char *curl_unescape(const char *string, int length) |
53 | 0 | { |
54 | 0 | return curl_easy_unescape(NULL, string, length, NULL); |
55 | 0 | } |
56 | | |
57 | | /* Escapes for URL the given unescaped string of given length. |
58 | | * 'data' is ignored since 7.82.0. |
59 | | */ |
60 | | char *curl_easy_escape(CURL *data, const char *string, |
61 | | int inlength) |
62 | 0 | { |
63 | 0 | size_t length; |
64 | 0 | struct dynbuf d; |
65 | 0 | (void)data; |
66 | |
|
67 | 0 | if(!string || (inlength < 0)) |
68 | 0 | return NULL; |
69 | | |
70 | 0 | length = (inlength ? (size_t)inlength : strlen(string)); |
71 | 0 | if(!length) |
72 | 0 | return strdup(""); |
73 | | |
74 | 0 | curlx_dyn_init(&d, length * 3 + 1); |
75 | |
|
76 | 0 | while(length--) { |
77 | | /* treat the characters unsigned */ |
78 | 0 | unsigned char in = (unsigned char)*string++; |
79 | |
|
80 | 0 | if(ISUNRESERVED(in)) { |
81 | | /* append this */ |
82 | 0 | if(curlx_dyn_addn(&d, &in, 1)) |
83 | 0 | return NULL; |
84 | 0 | } |
85 | 0 | else { |
86 | | /* encode it */ |
87 | 0 | unsigned char out[3]={'%'}; |
88 | 0 | Curl_hexbyte(&out[1], in, FALSE); |
89 | 0 | if(curlx_dyn_addn(&d, out, 3)) |
90 | 0 | return NULL; |
91 | 0 | } |
92 | 0 | } |
93 | | |
94 | 0 | return curlx_dyn_ptr(&d); |
95 | 0 | } |
96 | | |
97 | | /* |
98 | | * Curl_urldecode() URL decodes the given string. |
99 | | * |
100 | | * Returns a pointer to a malloced string in *ostring with length given in |
101 | | * *olen. If length == 0, the length is assumed to be strlen(string). |
102 | | * |
103 | | * ctrl options: |
104 | | * - REJECT_NADA: accept everything |
105 | | * - REJECT_CTRL: rejects control characters (byte codes lower than 32) in |
106 | | * the data |
107 | | * - REJECT_ZERO: rejects decoded zero bytes |
108 | | * |
109 | | * The values for the enum starts at 2, to make the assert detect legacy |
110 | | * invokes that used TRUE/FALSE (0 and 1). |
111 | | */ |
112 | | |
113 | | CURLcode Curl_urldecode(const char *string, size_t length, |
114 | | char **ostring, size_t *olen, |
115 | | enum urlreject ctrl) |
116 | 355 | { |
117 | 355 | size_t alloc; |
118 | 355 | char *ns; |
119 | | |
120 | 355 | DEBUGASSERT(string); |
121 | 355 | DEBUGASSERT(ctrl >= REJECT_NADA); /* crash on TRUE/FALSE */ |
122 | | |
123 | 355 | alloc = (length ? length : strlen(string)); |
124 | 355 | ns = malloc(alloc + 1); |
125 | | |
126 | 355 | if(!ns) |
127 | 0 | return CURLE_OUT_OF_MEMORY; |
128 | | |
129 | | /* store output string */ |
130 | 355 | *ostring = ns; |
131 | | |
132 | 10.1k | while(alloc) { |
133 | 9.76k | unsigned char in = (unsigned char)*string; |
134 | 9.76k | if(('%' == in) && (alloc > 2) && |
135 | 9.76k | ISXDIGIT(string[1]) && ISXDIGIT(string[2])) { |
136 | | /* this is two hexadecimal digits following a '%' */ |
137 | 12 | in = (unsigned char)((Curl_hexval(string[1]) << 4) | |
138 | 12 | Curl_hexval(string[2])); |
139 | 12 | string += 3; |
140 | 12 | alloc -= 3; |
141 | 12 | } |
142 | 9.75k | else { |
143 | 9.75k | string++; |
144 | 9.75k | alloc--; |
145 | 9.75k | } |
146 | | |
147 | 9.76k | if(((ctrl == REJECT_CTRL) && (in < 0x20)) || |
148 | 9.76k | ((ctrl == REJECT_ZERO) && (in == 0))) { |
149 | 0 | Curl_safefree(*ostring); |
150 | 0 | return CURLE_URL_MALFORMAT; |
151 | 0 | } |
152 | | |
153 | 9.76k | *ns++ = (char)in; |
154 | 9.76k | } |
155 | 355 | *ns = 0; /* terminate it */ |
156 | | |
157 | 355 | if(olen) |
158 | | /* store output size */ |
159 | 114 | *olen = ns - *ostring; |
160 | | |
161 | 355 | return CURLE_OK; |
162 | 355 | } |
163 | | |
164 | | /* |
165 | | * Unescapes the given URL escaped string of given length. Returns a |
166 | | * pointer to a malloced string with length given in *olen. |
167 | | * If length == 0, the length is assumed to be strlen(string). |
168 | | * If olen == NULL, no output length is stored. |
169 | | * 'data' is ignored since 7.82.0. |
170 | | */ |
171 | | char *curl_easy_unescape(CURL *data, const char *string, |
172 | | int length, int *olen) |
173 | 0 | { |
174 | 0 | char *str = NULL; |
175 | 0 | (void)data; |
176 | 0 | if(string && (length >= 0)) { |
177 | 0 | size_t inputlen = (size_t)length; |
178 | 0 | size_t outputlen; |
179 | 0 | CURLcode res = Curl_urldecode(string, inputlen, &str, &outputlen, |
180 | 0 | REJECT_NADA); |
181 | 0 | if(res) |
182 | 0 | return NULL; |
183 | | |
184 | 0 | if(olen) { |
185 | 0 | if(outputlen <= (size_t) INT_MAX) |
186 | 0 | *olen = curlx_uztosi(outputlen); |
187 | 0 | else |
188 | | /* too large to return in an int, fail! */ |
189 | 0 | Curl_safefree(str); |
190 | 0 | } |
191 | 0 | } |
192 | 0 | return str; |
193 | 0 | } |
194 | | |
195 | | /* For operating systems/environments that use different malloc/free |
196 | | systems for the app and for this library, we provide a free that uses |
197 | | the library's memory system */ |
198 | | void curl_free(void *p) |
199 | 0 | { |
200 | 0 | free(p); |
201 | 0 | } |
202 | | |
203 | | /* |
204 | | * Curl_hexencode() |
205 | | * |
206 | | * Converts binary input to lowercase hex-encoded ASCII output. |
207 | | * Null-terminated. |
208 | | */ |
209 | | void Curl_hexencode(const unsigned char *src, size_t len, /* input length */ |
210 | | unsigned char *out, size_t olen) /* output buffer size */ |
211 | 0 | { |
212 | 0 | DEBUGASSERT(src && len && (olen >= 3)); |
213 | 0 | if(src && len && (olen >= 3)) { |
214 | 0 | while(len-- && (olen >= 3)) { |
215 | 0 | Curl_hexbyte(out, *src, TRUE); |
216 | 0 | ++src; |
217 | 0 | out += 2; |
218 | 0 | olen -= 2; |
219 | 0 | } |
220 | 0 | *out = 0; |
221 | 0 | } |
222 | 0 | else if(olen) |
223 | 0 | *out = 0; |
224 | 0 | } |
225 | | |
226 | | /* Curl_hexbyte |
227 | | * |
228 | | * Output a single unsigned char as a two-digit hex number, lowercase or |
229 | | * uppercase |
230 | | */ |
231 | | void Curl_hexbyte(unsigned char *dest, /* must fit two bytes */ |
232 | | unsigned char val, |
233 | | bool lowercase) |
234 | 286k | { |
235 | 286k | const unsigned char *t = lowercase ? Curl_ldigits : Curl_udigits; |
236 | 286k | dest[0] = t[val >> 4]; |
237 | 286k | dest[1] = t[val & 0x0F]; |
238 | 286k | } |