mirror/zx2c4.cgit
1
0
Fork 0
mirror of https://git.zx2c4.com/cgit synced 2025-08-02 00:54:36 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

ui-shared: prevent malicious filename from injecting headers

Browse source
This commit is contained in:
Jason A. Donenfeld 2016-01-14 14:28:37 +01:00
parent 4291453ec3
commit 513b3863d9
3 changed files with 32 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

26
html.c
View file

@ -239,6 +239,32 @@ void html_url_arg(const char *txt)
html(txt);
}
void html_header_arg_in_quotes(const char *txt)
{
const char *t = txt;
while (t && *t) {
unsigned char c = *t;
const char *e = NULL;
if (c == '\\')
e = "\\\\";
else if (c == '\r')
e = "\\r";
else if (c == '\n')
e = "\\n";
else if (c == '"')
e = "\\\"";
if (e) {
html_raw(txt, t - txt);
html(e);
txt = t + 1;
}
t++;
}
if (t != txt)
html(txt);
}
void html_hidden(const char *name, const char *value)
{
html("<input type='hidden' name='");