Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 1 | /*************************************************************************** |
| 2 | * _ _ ____ _ |
| 3 | * Project ___| | | | _ \| | |
| 4 | * / __| | | | |_) | | |
| 5 | * | (__| |_| | _ <| |___ |
| 6 | * \___|\___/|_| \_\_____| |
| 7 | * |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 8 | * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al. |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 9 | * |
| 10 | * This software is licensed as described in the file COPYING, which |
| 11 | * you should have received as part of this distribution. The terms |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 12 | * are also available at https://curl.haxx.se/docs/copyright.html. |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 13 | * |
| 14 | * You may opt to use, copy, modify, merge, publish, distribute and/or sell |
| 15 | * copies of the Software, and permit persons to whom the Software is |
| 16 | * furnished to do so, under the terms of the COPYING file. |
| 17 | * |
| 18 | * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY |
| 19 | * KIND, either express or implied. |
| 20 | * |
| 21 | ***************************************************************************/ |
| 22 | |
| 23 | /* Escape and unescape URL encoding in strings. The functions return a new |
| 24 | * allocated string or NULL if an error occurred. */ |
| 25 | |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 26 | #include "curl_setup.h" |
| 27 | |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 28 | #include <curl/curl.h> |
| 29 | |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 30 | #include "urldata.h" |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 31 | #include "warnless.h" |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 32 | #include "non-ascii.h" |
| 33 | #include "escape.h" |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 34 | #include "strdup.h" |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 35 | /* The last 3 #include files should be in this order */ |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 36 | #include "curl_printf.h" |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 37 | #include "curl_memory.h" |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 38 | #include "memdebug.h" |
| 39 | |
| 40 | /* Portable character check (remember EBCDIC). Do not use isalnum() because |
Lucas Eckels | 9bd90e6 | 2012-08-06 15:07:02 -0700 | [diff] [blame] | 41 | its behavior is altered by the current locale. |
Alex Deymo | d15eaac | 2016-06-28 14:49:26 -0700 | [diff] [blame] | 42 | See https://tools.ietf.org/html/rfc3986#section-2.3 |
Lucas Eckels | 9bd90e6 | 2012-08-06 15:07:02 -0700 | [diff] [blame] | 43 | */ |
| 44 | static bool Curl_isunreserved(unsigned char in) |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 45 | { |
Elliott Hughes | 82be86d | 2017-09-20 17:00:17 -0700 | [diff] [blame] | 46 | switch(in) { |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 47 | case '0': case '1': case '2': case '3': case '4': |
| 48 | case '5': case '6': case '7': case '8': case '9': |
| 49 | case 'a': case 'b': case 'c': case 'd': case 'e': |
| 50 | case 'f': case 'g': case 'h': case 'i': case 'j': |
| 51 | case 'k': case 'l': case 'm': case 'n': case 'o': |
| 52 | case 'p': case 'q': case 'r': case 's': case 't': |
| 53 | case 'u': case 'v': case 'w': case 'x': case 'y': case 'z': |
| 54 | case 'A': case 'B': case 'C': case 'D': case 'E': |
| 55 | case 'F': case 'G': case 'H': case 'I': case 'J': |
| 56 | case 'K': case 'L': case 'M': case 'N': case 'O': |
| 57 | case 'P': case 'Q': case 'R': case 'S': case 'T': |
| 58 | case 'U': case 'V': case 'W': case 'X': case 'Y': case 'Z': |
Lucas Eckels | 9bd90e6 | 2012-08-06 15:07:02 -0700 | [diff] [blame] | 59 | case '-': case '.': case '_': case '~': |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 60 | return TRUE; |
| 61 | default: |
| 62 | break; |
| 63 | } |
| 64 | return FALSE; |
| 65 | } |
| 66 | |
| 67 | /* for ABI-compatibility with previous versions */ |
| 68 | char *curl_escape(const char *string, int inlength) |
| 69 | { |
| 70 | return curl_easy_escape(NULL, string, inlength); |
| 71 | } |
| 72 | |
| 73 | /* for ABI-compatibility with previous versions */ |
| 74 | char *curl_unescape(const char *string, int length) |
| 75 | { |
| 76 | return curl_easy_unescape(NULL, string, length, NULL); |
| 77 | } |
| 78 | |
Alex Deymo | e3149cc | 2016-10-05 11:18:42 -0700 | [diff] [blame] | 79 | char *curl_easy_escape(struct Curl_easy *data, const char *string, |
| 80 | int inlength) |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 81 | { |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 82 | size_t alloc; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 83 | char *ns; |
| 84 | char *testing_ptr = NULL; |
| 85 | unsigned char in; /* we need to treat the characters unsigned */ |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 86 | size_t newlen; |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 87 | size_t strindex = 0; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 88 | size_t length; |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 89 | CURLcode result; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 90 | |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 91 | if(inlength < 0) |
| 92 | return NULL; |
| 93 | |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 94 | alloc = (inlength?(size_t)inlength:strlen(string)) + 1; |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 95 | newlen = alloc; |
| 96 | |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 97 | ns = malloc(alloc); |
| 98 | if(!ns) |
| 99 | return NULL; |
| 100 | |
| 101 | length = alloc-1; |
| 102 | while(length--) { |
| 103 | in = *string; |
| 104 | |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 105 | if(Curl_isunreserved(in)) |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 106 | /* just copy this */ |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 107 | ns[strindex++] = in; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 108 | else { |
| 109 | /* encode it */ |
| 110 | newlen += 2; /* the size grows with two, since this'll become a %XX */ |
| 111 | if(newlen > alloc) { |
| 112 | alloc *= 2; |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 113 | testing_ptr = Curl_saferealloc(ns, alloc); |
| 114 | if(!testing_ptr) |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 115 | return NULL; |
Elliott Hughes | 82be86d | 2017-09-20 17:00:17 -0700 | [diff] [blame] | 116 | ns = testing_ptr; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 117 | } |
| 118 | |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 119 | result = Curl_convert_to_network(data, (char *)&in, 1); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 120 | if(result) { |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 121 | /* Curl_convert_to_network calls failf if unsuccessful */ |
| 122 | free(ns); |
| 123 | return NULL; |
| 124 | } |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 125 | |
| 126 | snprintf(&ns[strindex], 4, "%%%02X", in); |
| 127 | |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 128 | strindex += 3; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 129 | } |
| 130 | string++; |
| 131 | } |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 132 | ns[strindex] = 0; /* terminate it */ |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 133 | return ns; |
| 134 | } |
| 135 | |
| 136 | /* |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 137 | * Curl_urldecode() URL decodes the given string. |
| 138 | * |
| 139 | * Optionally detects control characters (byte codes lower than 32) in the |
| 140 | * data and rejects such data. |
| 141 | * |
| 142 | * Returns a pointer to a malloced string in *ostring with length given in |
| 143 | * *olen. If length == 0, the length is assumed to be strlen(string). |
| 144 | * |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 145 | */ |
Alex Deymo | e3149cc | 2016-10-05 11:18:42 -0700 | [diff] [blame] | 146 | CURLcode Curl_urldecode(struct Curl_easy *data, |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 147 | const char *string, size_t length, |
| 148 | char **ostring, size_t *olen, |
| 149 | bool reject_ctrl) |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 150 | { |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 151 | size_t alloc = (length?length:strlen(string)) + 1; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 152 | char *ns = malloc(alloc); |
| 153 | unsigned char in; |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 154 | size_t strindex = 0; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 155 | unsigned long hex; |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 156 | CURLcode result; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 157 | |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 158 | if(!ns) |
| 159 | return CURLE_OUT_OF_MEMORY; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 160 | |
| 161 | while(--alloc > 0) { |
| 162 | in = *string; |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 163 | if(('%' == in) && (alloc > 2) && |
| 164 | ISXDIGIT(string[1]) && ISXDIGIT(string[2])) { |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 165 | /* this is two hexadecimal digits following a '%' */ |
| 166 | char hexstr[3]; |
| 167 | char *ptr; |
| 168 | hexstr[0] = string[1]; |
| 169 | hexstr[1] = string[2]; |
| 170 | hexstr[2] = 0; |
| 171 | |
| 172 | hex = strtoul(hexstr, &ptr, 16); |
| 173 | |
| 174 | in = curlx_ultouc(hex); /* this long is never bigger than 255 anyway */ |
| 175 | |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 176 | result = Curl_convert_from_network(data, (char *)&in, 1); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 177 | if(result) { |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 178 | /* Curl_convert_from_network calls failf if unsuccessful */ |
| 179 | free(ns); |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 180 | return result; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 181 | } |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 182 | |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 183 | string += 2; |
| 184 | alloc -= 2; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 185 | } |
| 186 | |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 187 | if(reject_ctrl && (in < 0x20)) { |
| 188 | free(ns); |
| 189 | return CURLE_URL_MALFORMAT; |
| 190 | } |
| 191 | |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 192 | ns[strindex++] = in; |
| 193 | string++; |
| 194 | } |
Alex Deymo | 486467e | 2017-12-19 19:04:07 +0100 | [diff] [blame] | 195 | ns[strindex] = 0; /* terminate it */ |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 196 | |
| 197 | if(olen) |
| 198 | /* store output size */ |
| 199 | *olen = strindex; |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 200 | |
| 201 | /* store output string */ |
| 202 | *ostring = ns; |
| 203 | |
| 204 | return CURLE_OK; |
| 205 | } |
| 206 | |
| 207 | /* |
| 208 | * Unescapes the given URL escaped string of given length. Returns a |
| 209 | * pointer to a malloced string with length given in *olen. |
| 210 | * If length == 0, the length is assumed to be strlen(string). |
| 211 | * If olen == NULL, no output length is stored. |
| 212 | */ |
Alex Deymo | e3149cc | 2016-10-05 11:18:42 -0700 | [diff] [blame] | 213 | char *curl_easy_unescape(struct Curl_easy *data, const char *string, |
| 214 | int length, int *olen) |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 215 | { |
| 216 | char *str = NULL; |
Elliott Hughes | cee0338 | 2017-06-23 12:17:18 -0700 | [diff] [blame] | 217 | if(length >= 0) { |
| 218 | size_t inputlen = length; |
| 219 | size_t outputlen; |
| 220 | CURLcode res = Curl_urldecode(data, string, inputlen, &str, &outputlen, |
| 221 | FALSE); |
| 222 | if(res) |
| 223 | return NULL; |
| 224 | |
| 225 | if(olen) { |
| 226 | if(outputlen <= (size_t) INT_MAX) |
| 227 | *olen = curlx_uztosi(outputlen); |
| 228 | else |
| 229 | /* too large to return in an int, fail! */ |
| 230 | Curl_safefree(str); |
| 231 | } |
| 232 | } |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 233 | return str; |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 234 | } |
| 235 | |
| 236 | /* For operating systems/environments that use different malloc/free |
| 237 | systems for the app and for this library, we provide a free that uses |
| 238 | the library's memory system */ |
| 239 | void curl_free(void *p) |
| 240 | { |
Bertrand SIMONNET | e6cd738 | 2015-07-01 15:39:44 -0700 | [diff] [blame] | 241 | free(p); |
Kristian Monsen | 5ab5018 | 2010-05-14 18:53:44 +0100 | [diff] [blame] | 242 | } |