← Back to branch summary

~ubuntu-branches/ubuntu/wily/libxml2/wily-proposed

« back to all changes in this revision

Viewing changes to HTMLtree.c

  • Committer: Package Import Robot
  • Author(s): Aron Xu
  • Date: 2014-10-26 07:04:50 UTC
  • mfrom: (43.2.7 sid)
  • Revision ID: package-import@ubuntu.com-20141026070450-rmcqvcqn8peeuebs
Tags: 2.9.2+dfsg1-1
http://bugs.debian.org/765722
* New upstream release (Closes: #765722, CVE-2014-3660)
* Remove no-longer-needed upstream patches
* Update distro patch
* Std-ver: 3.9.5 -> 3.9.6, no change.

Show diffs side-by-side

added added

removed removed

Lines of Context:
HTMLtree.c
716
716
                 (!xmlStrcasecmp(cur->name, BAD_CAST "src")) ||
717
717
                 ((!xmlStrcasecmp(cur->name, BAD_CAST "name")) &&
718
718
                  (!xmlStrcasecmp(cur->parent->name, BAD_CAST "a"))))) {
719
 
                xmlChar *escaped;
720
719
                xmlChar *tmp = value;
 
720
                /* xmlURIEscapeStr() escapes '"' so it can be safely used. */
 
721
                xmlBufCCat(buf->buffer, "\"");
721
722
 
722
723
                while (IS_BLANK_CH(*tmp)) tmp++;
723
724
 
724
 
                /*
725
 
                 * the < and > have already been escaped at the entity level
726
 
                 * And doing so here breaks server side includes
727
 
                 */
728
 
                escaped = xmlURIEscapeStr(tmp, BAD_CAST"@/:=?;#%&,+<>");
729
 
                if (escaped != NULL) {
730
 
                    xmlBufWriteQuotedString(buf->buffer, escaped);
731
 
                    xmlFree(escaped);
732
 
                } else {
733
 
                    xmlBufWriteQuotedString(buf->buffer, value);
 
725
                /* URI Escape everything, except server side includes. */
 
726
                for ( ; ; ) {
 
727
                    xmlChar *escaped;
 
728
                    xmlChar endChar;
 
729
                    xmlChar *end = NULL;
 
730
                    xmlChar *start = (xmlChar *)xmlStrstr(tmp, BAD_CAST "<!--");
 
731
                    if (start != NULL) {
 
732
                        end = (xmlChar *)xmlStrstr(tmp, BAD_CAST "-->");
 
733
                        if (end != NULL) {
 
734
                            *start = '\0';
 
735
                        }
 
736
                    }
 
737
 
 
738
                    /* Escape the whole string, or until start (set to '\0'). */
 
739
                    escaped = xmlURIEscapeStr(tmp, BAD_CAST"@/:=?;#%&,+");
 
740
                    if (escaped != NULL) {
 
741
                        xmlBufCat(buf->buffer, escaped);
 
742
                        xmlFree(escaped);
 
743
                    } else {
 
744
                        xmlBufCat(buf->buffer, tmp);
 
745
                    }
 
746
 
 
747
                    if (end == NULL) { /* Everything has been written. */
 
748
                        break;
 
749
                    }
 
750
 
 
751
                    /* Do not escape anything within server side includes. */
 
752
                    *start = '<'; /* Restore the first character of "<!--". */
 
753
                    end += 3; /* strlen("-->") */
 
754
                    endChar = *end;
 
755
                    *end = '\0';
 
756
                    xmlBufCat(buf->buffer, start);
 
757
                    *end = endChar;
 
758
                    tmp = end;
734
759
                }
 
760
 
 
761
                xmlBufCCat(buf->buffer, "\"");
735
762
            } else {
736
763
                xmlBufWriteQuotedString(buf->buffer, value);
737
764
            }