escape.c 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2016, Daniel Stenberg, <[email protected]>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.haxx.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. ***************************************************************************/
  22. /* Escape and unescape URL encoding in strings. The functions return a new
  23. * allocated string or NULL if an error occurred. */
  24. #include "curl_setup.h"
  25. #include <curl/curl.h>
  26. #include "urldata.h"
  27. #include "warnless.h"
  28. #include "non-ascii.h"
  29. #include "escape.h"
  30. #include "strdup.h"
  31. /* The last 3 #include files should be in this order */
  32. #include "curl_printf.h"
  33. #include "curl_memory.h"
  34. #include "memdebug.h"
  35. /* Portable character check (remember EBCDIC). Do not use isalnum() because
  36. its behavior is altered by the current locale.
  37. See https://tools.ietf.org/html/rfc3986#section-2.3
  38. */
  39. static bool Curl_isunreserved(unsigned char in)
  40. {
  41. switch(in) {
  42. case '0': case '1': case '2': case '3': case '4':
  43. case '5': case '6': case '7': case '8': case '9':
  44. case 'a': case 'b': case 'c': case 'd': case 'e':
  45. case 'f': case 'g': case 'h': case 'i': case 'j':
  46. case 'k': case 'l': case 'm': case 'n': case 'o':
  47. case 'p': case 'q': case 'r': case 's': case 't':
  48. case 'u': case 'v': case 'w': case 'x': case 'y': case 'z':
  49. case 'A': case 'B': case 'C': case 'D': case 'E':
  50. case 'F': case 'G': case 'H': case 'I': case 'J':
  51. case 'K': case 'L': case 'M': case 'N': case 'O':
  52. case 'P': case 'Q': case 'R': case 'S': case 'T':
  53. case 'U': case 'V': case 'W': case 'X': case 'Y': case 'Z':
  54. case '-': case '.': case '_': case '~':
  55. return TRUE;
  56. default:
  57. break;
  58. }
  59. return FALSE;
  60. }
  61. /* for ABI-compatibility with previous versions */
  62. char *curl_escape(const char *string, int inlength)
  63. {
  64. return curl_easy_escape(NULL, string, inlength);
  65. }
  66. /* for ABI-compatibility with previous versions */
  67. char *curl_unescape(const char *string, int length)
  68. {
  69. return curl_easy_unescape(NULL, string, length, NULL);
  70. }
  71. char *curl_easy_escape(struct Curl_easy *data, const char *string,
  72. int inlength)
  73. {
  74. size_t alloc;
  75. char *ns;
  76. char *testing_ptr = NULL;
  77. unsigned char in; /* we need to treat the characters unsigned */
  78. size_t newlen;
  79. size_t strindex=0;
  80. size_t length;
  81. CURLcode result;
  82. if(inlength < 0)
  83. return NULL;
  84. alloc = (inlength?(size_t)inlength:strlen(string))+1;
  85. newlen = alloc;
  86. ns = malloc(alloc);
  87. if(!ns)
  88. return NULL;
  89. length = alloc-1;
  90. while(length--) {
  91. in = *string;
  92. if(Curl_isunreserved(in))
  93. /* just copy this */
  94. ns[strindex++]=in;
  95. else {
  96. /* encode it */
  97. newlen += 2; /* the size grows with two, since this'll become a %XX */
  98. if(newlen > alloc) {
  99. alloc *= 2;
  100. testing_ptr = Curl_saferealloc(ns, alloc);
  101. if(!testing_ptr)
  102. return NULL;
  103. else {
  104. ns = testing_ptr;
  105. }
  106. }
  107. result = Curl_convert_to_network(data, &in, 1);
  108. if(result) {
  109. /* Curl_convert_to_network calls failf if unsuccessful */
  110. free(ns);
  111. return NULL;
  112. }
  113. snprintf(&ns[strindex], 4, "%%%02X", in);
  114. strindex+=3;
  115. }
  116. string++;
  117. }
  118. ns[strindex]=0; /* terminate it */
  119. return ns;
  120. }
  121. /*
  122. * Curl_urldecode() URL decodes the given string.
  123. *
  124. * Optionally detects control characters (byte codes lower than 32) in the
  125. * data and rejects such data.
  126. *
  127. * Returns a pointer to a malloced string in *ostring with length given in
  128. * *olen. If length == 0, the length is assumed to be strlen(string).
  129. *
  130. */
  131. CURLcode Curl_urldecode(struct Curl_easy *data,
  132. const char *string, size_t length,
  133. char **ostring, size_t *olen,
  134. bool reject_ctrl)
  135. {
  136. size_t alloc = (length?length:strlen(string))+1;
  137. char *ns = malloc(alloc);
  138. unsigned char in;
  139. size_t strindex=0;
  140. unsigned long hex;
  141. CURLcode result;
  142. if(!ns)
  143. return CURLE_OUT_OF_MEMORY;
  144. while(--alloc > 0) {
  145. in = *string;
  146. if(('%' == in) && (alloc > 2) &&
  147. ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
  148. /* this is two hexadecimal digits following a '%' */
  149. char hexstr[3];
  150. char *ptr;
  151. hexstr[0] = string[1];
  152. hexstr[1] = string[2];
  153. hexstr[2] = 0;
  154. hex = strtoul(hexstr, &ptr, 16);
  155. in = curlx_ultouc(hex); /* this long is never bigger than 255 anyway */
  156. result = Curl_convert_from_network(data, &in, 1);
  157. if(result) {
  158. /* Curl_convert_from_network calls failf if unsuccessful */
  159. free(ns);
  160. return result;
  161. }
  162. string+=2;
  163. alloc-=2;
  164. }
  165. if(reject_ctrl && (in < 0x20)) {
  166. free(ns);
  167. return CURLE_URL_MALFORMAT;
  168. }
  169. ns[strindex++] = in;
  170. string++;
  171. }
  172. ns[strindex]=0; /* terminate it */
  173. if(olen)
  174. /* store output size */
  175. *olen = strindex;
  176. /* store output string */
  177. *ostring = ns;
  178. return CURLE_OK;
  179. }
  180. /*
  181. * Unescapes the given URL escaped string of given length. Returns a
  182. * pointer to a malloced string with length given in *olen.
  183. * If length == 0, the length is assumed to be strlen(string).
  184. * If olen == NULL, no output length is stored.
  185. */
  186. char *curl_easy_unescape(struct Curl_easy *data, const char *string,
  187. int length, int *olen)
  188. {
  189. char *str = NULL;
  190. if(length >= 0) {
  191. size_t inputlen = length;
  192. size_t outputlen;
  193. CURLcode res = Curl_urldecode(data, string, inputlen, &str, &outputlen,
  194. FALSE);
  195. if(res)
  196. return NULL;
  197. if(olen) {
  198. if(outputlen <= (size_t) INT_MAX)
  199. *olen = curlx_uztosi(outputlen);
  200. else
  201. /* too large to return in an int, fail! */
  202. Curl_safefree(str);
  203. }
  204. }
  205. return str;
  206. }
  207. /* For operating systems/environments that use different malloc/free
  208. systems for the app and for this library, we provide a free that uses
  209. the library's memory system */
  210. void curl_free(void *p)
  211. {
  212. free(p);
  213. }