replace_untrusted_chars: replace all whitespace with space

[elogind.git] / udev_utils_string.c

diff --git a/udev_utils_string.c b/udev_utils_string.c
index b0641f002b01b2c1f676c41900518c27e447c5b5..6f51aef01417790988d55683fd1435796a128704 100644 (file)
--- a/udev_utils_string.c
+++ b/udev_utils_string.c
@@ -58,11 +58,11 @@ size_t path_encode(char *s, size_t len)
        t[0] = '\0';
        for (i = 0, j = 0; s[i] != '\0'; i++) {
                if (s[i] == '/') {
-                       memcpy(&t[j], "%2f", 3);
-                       j += 3;
-               } else if (s[i] == '%') {
-                       memcpy(&t[j], "%25", 3);
-                       j += 3;
+                       memcpy(&t[j], "\\x2f", 4);
+                       j += 4;
+               } else if (s[i] == '\\') {
+                       memcpy(&t[j], "\\x5c", 4);
+                       j += 4;
                } else {
                        t[j] = s[i];
                        j++;
@@ -78,12 +78,12 @@ size_t path_decode(char *s)
        size_t i, j;
 
        for (i = 0, j = 0; s[i] != '\0'; j++) {
-               if (memcmp(&s[i], "%2f", 3) == 0) {
+               if (memcmp(&s[i], "\\x2f", 4) == 0) {
                        s[j] = '/';
-                       i += 3;
-               }else if (memcmp(&s[i], "%25", 3) == 0) {
-                       s[j] = '%';
-                       i += 3;
+                       i += 4;
+               }else if (memcmp(&s[i], "\\x5c", 4) == 0) {
+                       s[j] = '\\';
+                       i += 4;
                } else {
                        s[j] = s[i];
                        i++;
@@ -229,10 +229,17 @@ int replace_untrusted_chars(char *str)
                if ((str[i] >= '0' && str[i] <= '9') ||
                    (str[i] >= 'A' && str[i] <= 'Z') ||
                    (str[i] >= 'a' && str[i] <= 'z') ||
-                   strchr(" #$%+-./:=?@_,", str[i])) {
+                   strchr("#$%+-./:=?@_,", str[i])) {
                        i++;
                        continue;
                }
+
+               /* hex encoding */
+               if (str[i] == '\\' && str[i+1] == 'x') {
+                       i += 2;
+                       continue;
+               }
+
                /* valid utf8 is accepted */
                len = utf8_encoded_valid_unichar(&str[i]);
                if (len > 1) {
@@ -240,6 +247,14 @@ int replace_untrusted_chars(char *str)
                        continue;
                }
 
+               /* whitespace replaced with ordinary space */
+               if (isspace(str[i])) {
+                       str[i] = ' ';
+                       i++;
+                       replaced++;
+                       continue;
+               }
+
                /* everything else is garbage */
                str[i] = '_';
                i++;