X-Git-Url: http://the.earth.li/gitweb/?a=blobdiff_plain;f=keyindex.c;h=3ce87359311a3f71d257875d5d6f69d3c6944954;hb=HEAD;hp=e8d569a45b22de0d04e4ab4a9eae82af3acf1839;hpb=97be85bfba76b9ed0aa6ad01afc7c6efc4b370d5;p=onak.git

diff --git a/keyindex.c b/keyindex.c
index e8d569a..3ce8735 100644
--- a/keyindex.c
+++ b/keyindex.c
@@ -24,7 +24,6 @@
 #include <time.h>
 
 #include "decodekey.h"
-#include "getcgi.h"
 #include "keydb.h"
 #include "keyid.h"
 #include "keyindex.h"
@@ -74,6 +73,85 @@ char pkalgo2char(uint8_t algo)
 	return typech;
 }
 
+/**
+ *	html_escape - Takes a string and converts it to HTML.
+ *	@src: The string to HTMLize.
+ *	@src_len: The length of the source string
+ *	@dst: A buffer to put the escaped string into
+ *	@dst_len: Length of the destination buffer (including a trailing NULL)
+ *
+ *	Takes a string and escapes any HTML entities (<, >, &, ", '). Returns
+ *	dst.
+ */
+const char *html_escape(const char *src, size_t src_len,
+		char *dst, size_t dst_len)
+{
+	size_t in_pos, out_pos;
+
+	dst_len--;
+
+	for (in_pos = 0, out_pos = 0;
+			in_pos < src_len && out_pos < (dst_len - 1);
+			in_pos++, out_pos++) {
+		switch (src[in_pos]) {
+		case '<':
+			if ((out_pos + 4) >= dst_len) {
+				break;
+			}
+			dst[out_pos++] = '&';
+			dst[out_pos++] = 'l';
+			dst[out_pos++] = 't';
+			dst[out_pos] = ';';
+			break;
+		case '>':
+			if ((out_pos + 4) >= dst_len) {
+				break;
+			}
+			dst[out_pos++] = '&';
+			dst[out_pos++] = 'g';
+			dst[out_pos++] = 't';
+			dst[out_pos] = ';';
+			break;
+		case '"':
+			if ((out_pos + 6) >= dst_len) {
+				break;
+			}
+			dst[out_pos++] = '&';
+			dst[out_pos++] = 'q';
+			dst[out_pos++] = 'u';
+			dst[out_pos++] = 'o';
+			dst[out_pos++] = 't';
+			dst[out_pos] = ';';
+			break;
+		case '\'':
+			if ((out_pos + 5) >= dst_len) {
+				break;
+			}
+			dst[out_pos++] = '&';
+			dst[out_pos++] = '#';
+			dst[out_pos++] = '3';
+			dst[out_pos++] = '9';
+			dst[out_pos] = ';';
+			break;
+		case '&':
+			if ((out_pos + 5) >= dst_len) {
+				break;
+			}
+			dst[out_pos++] = '&';
+			dst[out_pos++] = 'a';
+			dst[out_pos++] = 'm';
+			dst[out_pos++] = 'p';
+			dst[out_pos] = ';';
+			break;
+		default:
+			dst[out_pos] = src[in_pos];
+		}
+	}
+	dst[out_pos] = 0;
+
+	return dst;
+}
+
 /*
  * Given a public key/subkey packet return the key length.
  */
@@ -144,6 +222,7 @@ int list_sigs(struct onak_dbctx *dbctx,
 	char *uid = NULL;
 	uint64_t sigid = 0;
 	char *sig = NULL;
+	char buf[1024];
 
 	while (sigs != NULL) {
 		sigid = sig_keyid(sigs->packet);
@@ -167,7 +246,7 @@ int list_sigs(struct onak_dbctx *dbctx,
 				sigid,
 				sigid,
 				sigid,
-				txt2html(uid));
+				html_escape(uid, strlen(uid), buf, sizeof(buf)));
 		} else if (html && uid == NULL) {
 			printf("%s         0x%016" PRIX64 "             "
 				"[User id not found]\n",
@@ -203,8 +282,17 @@ int list_uids(struct onak_dbctx *dbctx,
 			snprintf(buf, 1023, "%.*s",
 				(int) uids->packet->length,
 				uids->packet->data);
-			printf("                                %s\n",
-				(html) ? txt2html(buf) : buf);
+			if (html) {
+				printf("                                %s\n",
+					html_escape((char *) uids->packet->data,
+						uids->packet->length,
+						buf,
+						sizeof(buf)));
+			} else {
+				printf("                                %.*s\n",
+					(int) uids->packet->length,
+					uids->packet->data);
+			}
 		} else if (uids->packet->tag == OPENPGP_PACKET_UAT) {
 			printf("                                ");
 			if (html) {
@@ -410,18 +498,22 @@ int key_index(struct onak_dbctx *dbctx,
 		curuid = keys->uids;
 		if (curuid != NULL &&
 				curuid->packet->tag == OPENPGP_PACKET_UID) {
-			snprintf(buf, 1023, "%.*s",
-				(int) curuid->packet->length,
-				curuid->packet->data);
 			if (html) {
 				printf("<a href=\"lookup?op=vindex&"
-					"search=0x%016" PRIX64 "\">",
-					keyid);
+					"search=0x%016" PRIX64 "\">"
+					"%s</a>%s\n",
+					keyid,
+					html_escape((char *) curuid->packet->data,
+						curuid->packet->length,
+						buf,
+						sizeof(buf)),
+					(keys->revoked) ? " *** REVOKED ***" : "");
+			} else {
+				printf("%.*s%s\n",
+					(int) curuid->packet->length,
+					curuid->packet->data,
+					(keys->revoked) ? " *** REVOKED ***" : "");
 			}
-			printf("%s%s%s\n", 
-				(html) ? txt2html(buf) : buf,
-				(html) ? "</a>" : "",
-				(keys->revoked) ? " *** REVOKED ***" : "");
 			if (skshash) {
 				display_skshash(keys, html);
 			}