Changeset 21 in code for trunk

Timestamp:

Oct 30, 2016, 12:24:56 PM (9 years ago)

Author:

asciimoo

Message:

[fix] attribute escaping - better solution in the future: ​https://github.com/golang/go/issues/17667

File:

• trunk/morty.go (modified) (5 diffs)

trunk/morty.go

@@ -29 +29 @@
 
 var CLIENT *fasthttp.Client = &fasthttp.Client{
+        Dial:                fasthttp.DialDualStack,
         MaxResponseBodySize: 10 * 1024 * 1024, // 10M
 }
@@ -343 +344 @@
                                         for {
                                                 attrName, attrValue, moreAttr := decoder.TagAttr()
-                                                attrs = append(attrs, [][]byte{attrName, attrValue})
+                                                attrs = append(attrs, [][]byte{
+                                                        attrName,
+                                                        attrValue,
+                                                        []byte(html.EscapeString(string(attrValue))),
+                                                })
                                                 if !moreAttr {
                                                         break
@@ -464 +469 @@
                 out.Write([]byte("<link"))
                 for _, attr := range attrs {
-                        sanitizeAttr(rc, out, attr[0], attr[1])
+                        sanitizeAttr(rc, out, attr[0], attr[1], attr[2])
                 }
                 out.Write([]byte(">"))
@@ -499 +504 @@
 func sanitizeAttrs(rc *RequestConfig, out io.Writer, attrs [][][]byte) {
         for _, attr := range attrs {
-                sanitizeAttr(rc, out, attr[0], attr[1])
-        }
-}
-
-func sanitizeAttr(rc *RequestConfig, out io.Writer, attrName, attrValue []byte) {
+                sanitizeAttr(rc, out, attr[0], attr[1], attr[2])
+        }
+}
+
+func sanitizeAttr(rc *RequestConfig, out io.Writer, attrName, attrValue, escapedAttrValue []byte) {
         if inArray(attrName, SAFE_ATTRIBUTES) {
-                fmt.Fprintf(out, " %s=\"%s\"", attrName, attrValue)
+                fmt.Fprintf(out, " %s=\"%s\"", attrName, escapedAttrValue)
                 return
         }
@@ -516 +521 @@
                 }
         case "style":
-                fmt.Fprintf(out, " %s=\"", attrName)
-                sanitizeCSS(rc, out, attrValue)
-                out.Write([]byte("\""))
+                cssAttr := bytes.NewBuffer(nil)
+                sanitizeCSS(rc, cssAttr, attrValue)
+                fmt.Fprintf(out, " %s=\"%s\"", attrName, html.EscapeString(string(cssAttr.Bytes())))
         }
 }