Changeset 28898 for main/trunk/greenstone2/runtime-src/src/recpt/securitytools.cpp

Timestamp:

2014-03-14T17:13:56+13:00 (10 years ago)

Author:

ak19

Message:

1. The cgiargq query variable is now no longer escaped in the 3 simply or large forms that use it. fqv and other js escaped fields are unchanged, since the jssafe now ensures that backslashes are escaped for macro files, so these resolve correctly in query.dm. 2. securitytools.cpp and .h updated to additionally escape back slashes for macro files when javascript escaping. This is done by default, since jssafe variants of cgiargs are all that are used, and they're used in macro files. 3. Encoded versions of decodedcompressedoptions are now used in all macro files. They're always used in attributes, so the attrsafe version which is set in receptionist.cpp is used.

File:

• main/trunk/greenstone2/runtime-src/src/recpt/securitytools.cpp (modified) (4 diffs)

main/trunk/greenstone2/runtime-src/src/recpt/securitytools.cpp

@@ -125 +125 @@
 }
 
-text_t encodeForJavascript(const text_t& in, const text_t& immuneChars) {
-  text_t out;
-  text_t::const_iterator here = in.begin();
-  text_t::const_iterator end = in.end();
-  while (here != end) {
-    out += encodeForJavascript(immuneChars, *here); // IMMUNE_JAVASCRIPT by default
-    ++here;
-  }
-  return out;
-}
+text_t encodeForJavascript(const text_t& in, const text_t& immuneChars, bool dmsafe) {
+  text_t out;
+  text_t::const_iterator here = in.begin();
+  text_t::const_iterator end = in.end();
+  while (here != end) {
+    out += encodeForJavascript(immuneChars, *here, dmsafe); // IMMUNE_JAVASCRIPT by default
+    ++here;
+  }
+  return out;
+}
+
 
 text_t encodeForMySQL(const text_t& in, const text_t& immuneChars, const SQLMode mode) {
@@ -259 +260 @@
 
 // http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/JavaScriptCodec.java
-text_t encodeForJavascript(const text_t& immuneChars, const unsigned short in) {
+text_t encodeForJavascript(const text_t& immuneChars, const unsigned short in, bool dmsafe) {
   
   text_t result = "";
@@ -294 +295 @@
       char hex_char[3];
       sprintf(hex_char,"%02X",in);
-      result = "\\x" + text_t(hex_char);
+
+      if(dmsafe) { // double escape backslashes for macro files
+    result = "\\\\x" + text_t(hex_char);
+      } else {
+    result = "\\x" + text_t(hex_char);
+      }
     }
     // otherwise encode with \\uHHHH
@@ -300 +306 @@
       char hex_char[5];
       sprintf(hex_char,"%04X",in);
-      result = "\\u" + text_t(hex_char);
+      if(dmsafe) { // double escape backslashes for macro files
+    result = "\\\\u" + text_t(hex_char);
+      } else {
+    result = "\\u" + text_t(hex_char);      
+      }
     }