From 4a73c7164a28728de0b717e869704c803ef9ca65 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Paul=20H=C3=A4nsch?= <paul@plutz.net>
Date: Mon, 8 Jun 2020 15:36:40 +0200
Subject: [PATCH] limit escaping to necessary characters, more readable output,
 much faster escaping functions

---
 cgilite.sh | 51 +++++++++++++++++++++++++++------------------------
 1 file changed, 27 insertions(+), 24 deletions(-)

diff --git a/cgilite.sh b/cgilite.sh
index 86ad280..b7067a7 100755
--- a/cgilite.sh
+++ b/cgilite.sh
@@ -187,35 +187,38 @@ COOKIE(){
 }
 
 HTML(){
-  # HTML Entity Coding
-  # Prints UTF-8 string as decimal Unicode Code Points
-  # Useful for escaping user input for use in HTML text and attributes
-  { [ $# -eq 0 ] && cat || printf %s "$*"; } \
-  | hexdump -ve '/1 "%03o\n"' \
-  | while read n; do
-    case $n in
-      # bitbanging octal UTF-8 chains into singular 7 digit octal numbers
-      [01]??) printf '0000%s' $n;; # 7 bit ASCII character, nothing to do
-      2??)    printf '%s' ${n#2};; # tail fragment, append 6 bit
-      3[0123]?) printf '000%s' ${n#3};; # 2 octet (11 bit) chain start
-      34?) printf '00%s' ${n#34};; # 3 octet (16 bit) chain start
-      35?) printf '01%s' ${n#35};; # 3 octet chain start, high
-      36?) printf '%s' ${n#36};;   # 4 octet (21 bit) chain start
+  local str out
+  [ $# -eq 0 ] && str="$(cat)" || str="$*"
+  while [ "$str" ]; do
+    case $str in
+      \&*) out="${out}&amp;";;
+      \<*) out="${out}&lt;";;
+      \>*) out="${out}&gt;";;
+      \"*) out="${out}&quot;";;
+      \'*) out="${out}&#x27;";;
+      *) out="${out}${str%"${str#?}"}";;
     esac
-  done \
-  | sed -E 's;.{7};&\n;g;' \
-  | while read n; do
-    printf '&#%d;' $((0$n))
+    str="${str#?}"
   done
+  printf %s "$out"
 }
 
 URL(){
-  # Code every character in URL escape hex format
-  # except alphanumeric ascii
-
-  { [ $# -eq 0 ] && cat || printf %s "$*"; } \
-  | hexdump -v -e '/1 ",%02X"' \
-  | sed 's;,;%;g; s;%2F;/;g;'
+  local str out
+  [ $# -eq 0 ] && str="$(cat)" || str="$*"
+  while [ "$str" ]; do
+    case $str in
+      \&*) out="${out}%26";;
+      \"*) out="${out}%22";;
+      \'*) out="${out}%27";;
+      \?*) out="${out}%3F";;
+      \#*) out="${out}%23";;
+      %*) out="${out}%25";;
+      *) out="${out}${str%"${str#?}"}";;
+    esac
+    str="${str#?}"
+  done
+  printf %s "$out"
 }
 
 SET_COOKIE(){
-- 
2.39.2