Improve HTML escaping of attribute on output
Handle special cases of &{...} constructs as hinted in the spec
http://www.w3.org/TR/html401/appendix/notes.html#h-B.7.1
and special values as comment <!-- ... --> used for server side includes
This is limited to attribute values in HTML content.
diff --git a/entities.c b/entities.c
index 7d06820..f9e9cd9 100644
--- a/entities.c
+++ b/entities.c
@@ -537,11 +537,11 @@
buffer_size = new_size; \
}
-
/**
- * xmlEncodeEntitiesReentrant:
+ * xmlEncodeEntitiesInternal:
* @doc: the document containing the string
* @input: A string to convert to XML.
+ * @attr: are we handling an atrbute value
*
* Do a global encoding of a string, replacing the predefined entities
* and non ASCII values with their entities and CharRef counterparts.
@@ -550,8 +550,8 @@
*
* Returns A newly allocated string with the substitution done.
*/
-xmlChar *
-xmlEncodeEntitiesReentrant(xmlDocPtr doc, const xmlChar *input) {
+static xmlChar *
+xmlEncodeEntitiesInternal(xmlDocPtr doc, const xmlChar *input, int attr) {
const xmlChar *cur = input;
xmlChar *buffer = NULL;
xmlChar *out = NULL;
@@ -568,7 +568,7 @@
buffer_size = 1000;
buffer = (xmlChar *) xmlMalloc(buffer_size * sizeof(xmlChar));
if (buffer == NULL) {
- xmlEntitiesErrMemory("xmlEncodeEntitiesReentrant: malloc failed");
+ xmlEntitiesErrMemory("xmlEncodeEntities: malloc failed");
return(NULL);
}
out = buffer;
@@ -585,6 +585,27 @@
* By default one have to encode at least '<', '>', '"' and '&' !
*/
if (*cur == '<') {
+ const xmlChar *end;
+
+ /*
+ * Special handling of server side include in HTML attributes
+ */
+ if (html && attr &&
+ (cur[1] == '!') && (cur[2] == '-') && (cur[3] == '-') &&
+ ((end = xmlStrstr(cur, BAD_CAST "-->")) != NULL)) {
+ while (cur != end) {
+ *out++ = *cur++;
+ indx = out - buffer;
+ if (indx + 100 > buffer_size) {
+ growBufferReentrant();
+ out = &buffer[indx];
+ }
+ }
+ *out++ = *cur++;
+ *out++ = *cur++;
+ *out++ = *cur++;
+ continue;
+ }
*out++ = '&';
*out++ = 'l';
*out++ = 't';
@@ -595,6 +616,22 @@
*out++ = 't';
*out++ = ';';
} else if (*cur == '&') {
+ /*
+ * Special handling of &{...} construct from HTML 4, see
+ * http://www.w3.org/TR/html401/appendix/notes.html#h-B.7.1
+ */
+ if (html && attr && (cur[1] == '{') && (strchr(cur, '}'))) {
+ while (*cur != '}') {
+ *out++ = *cur++;
+ indx = out - buffer;
+ if (indx + 100 > buffer_size) {
+ growBufferReentrant();
+ out = &buffer[indx];
+ }
+ }
+ *out++ = *cur++;
+ continue;
+ }
*out++ = '&';
*out++ = 'a';
*out++ = 'm';
@@ -627,7 +664,7 @@
if (*cur < 0xC0) {
xmlEntitiesErr(XML_CHECK_NOT_UTF8,
- "xmlEncodeEntitiesReentrant : input not UTF-8");
+ "xmlEncodeEntities: input not UTF-8");
if (doc != NULL)
doc->encoding = xmlStrdup(BAD_CAST "ISO-8859-1");
snprintf(buf, sizeof(buf), "&#%d;", *cur);
@@ -660,7 +697,7 @@
}
if ((l == 1) || (!IS_CHAR(val))) {
xmlEntitiesErr(XML_ERR_INVALID_CHAR,
- "xmlEncodeEntitiesReentrant : char out of range\n");
+ "xmlEncodeEntities: char out of range\n");
if (doc != NULL)
doc->encoding = xmlStrdup(BAD_CAST "ISO-8859-1");
snprintf(buf, sizeof(buf), "&#%d;", *cur);
@@ -694,12 +731,45 @@
return(buffer);
mem_error:
- xmlEntitiesErrMemory("xmlEncodeEntitiesReentrant: realloc failed");
+ xmlEntitiesErrMemory("xmlEncodeEntities: realloc failed");
xmlFree(buffer);
return(NULL);
}
/**
+ * xmlEncodeAttributeEntities:
+ * @doc: the document containing the string
+ * @input: A string to convert to XML.
+ *
+ * Do a global encoding of a string, replacing the predefined entities
+ * and non ASCII values with their entities and CharRef counterparts for
+ * attribute values.
+ *
+ * Returns A newly allocated string with the substitution done.
+ */
+xmlChar *
+xmlEncodeAttributeEntities(xmlDocPtr doc, const xmlChar *input) {
+ return xmlEncodeEntitiesInternal(doc, input, 1);
+}
+
+/**
+ * xmlEncodeEntitiesReentrant:
+ * @doc: the document containing the string
+ * @input: A string to convert to XML.
+ *
+ * Do a global encoding of a string, replacing the predefined entities
+ * and non ASCII values with their entities and CharRef counterparts.
+ * Contrary to xmlEncodeEntities, this routine is reentrant, and result
+ * must be deallocated.
+ *
+ * Returns A newly allocated string with the substitution done.
+ */
+xmlChar *
+xmlEncodeEntitiesReentrant(xmlDocPtr doc, const xmlChar *input) {
+ return xmlEncodeEntitiesInternal(doc, input, 0);
+}
+
+/**
* xmlEncodeSpecialChars:
* @doc: the document containing the string
* @input: A string to convert to XML.