bugfix: prevent HTML injection in reference style link titles

[cgilite] / markdown.awk

diff --git a/markdown.awk b/markdown.awk
index 512be5d5723da1f9a049bb1ba31241d813dba5ac..27d40156a414ed45f6053a758b1a9fa2f6cc254c 100755 (executable)
--- a/markdown.awk
+++ b/markdown.awk
@@ -145,11 +145,11 @@ function inline( line, LOCAL, len, code, href, guard ) {
       id = gensub(/^\[([^\n]+)\] ?\[([^\n]*)\].*/, "\\2", 1, line);
     if ( ! id ) id = text;
     if ( rl_href[id] && rl_title[id] ) {
-      return "<a href=\"" rl_href[id] "\" title=\"" rl_title[id] "\">" inline(text) "</a>" inline( substr( line, len + 1) );
+      return "<a href=\"" HTML(rl_href[id]) "\" title=\"" HTML(rl_title[id]) "\">" inline(text) "</a>" inline( substr( line, len + 1) );
     } else if ( rl_href[id] ) {
-      return "<a href=\"" rl_href[id] "\">" inline(text) "</a>" inline( substr( line, len + 1) );
+      return "<a href=\"" HTML(rl_href[id]) "\">" inline(text) "</a>" inline( substr( line, len + 1) );
     } else {
-      return "" substr(line, 1, len) inline( substr(line, len + 1) );
+      return "" HTML(substr(line, 1, len)) inline( substr(line, len + 1) );
     }
 
   # inline images
@@ -171,11 +171,11 @@ function inline( line, LOCAL, len, code, href, guard ) {
       id = gensub(/^!\[([^\n]+)\] ?\[([^\n]*)\].*/, "\\2", 1, line);
     if ( ! id ) id = text;
     if ( rl_href[id] && rl_title[id] ) {
-      return "<img src=\"" rl_href[id] "\" alt=\"" HTML(text) "\" title=\"" rl_title[id] "\" />" inline( substr( line, len + 1) );
+      return "<img src=\"" HTML(rl_href[id]) "\" alt=\"" HTML(text) "\" title=\"" HTML(rl_title[id]) "\" />" inline( substr( line, len + 1) );
     } else if ( rl_href[id] ) {
-      return "<img src=\"" rl_href[id] "\" alt=\"" HTML(text) "\" />" inline( substr( line, len + 1) );
+      return "<img src=\"" HTML(rl_href[id]) "\" alt=\"" HTML(text) "\" />" inline( substr( line, len + 1) );
     } else {
-      return "" substr(line, 1, len) inline( substr(line, len + 1) );
+      return "" HTML(substr(line, 1, len)) inline( substr(line, len + 1) );
     }
 
   #  ~~strikeout~~ (pandoc)
@@ -195,7 +195,7 @@ function inline( line, LOCAL, len, code, href, guard ) {
 
   # ignore embedded underscores (pandoc, php md)
   } else if ( match(line, "^[[:alnum:]](__|_)") ) {
-    return substr( line, 1, RLENGTH) inline( substr(line, RLENGTH + 1) );
+    return HTML(substr( line, 1, RLENGTH)) inline( substr(line, RLENGTH + 1) );
 
   #  __strong__$
   } else if ( match(line, "^__(([^_[:space:]]|" ieu ")|([^_[:space:]]|" ieu ")(" nu "|" ieu ")*([^_[:space:]]|" ieu "))__$") ) {
@@ -227,6 +227,11 @@ function inline( line, LOCAL, len, code, href, guard ) {
     len = RLENGTH;
     return "<em>" inline( substr( line, 2, len - 2 ) ) "</em>" inline( substr( line, len + 1 ) );
 
+  # Macros
+  } else if ( AllowMacros && match( line, /^<<([^>]|>[^>])+>>/) ) {
+    len = RLENGTH;
+    return macro( substr( line, 3, len - 4 ) ) inline(substr(line, len + 1));
+
   # Verbatim inline HTML
   } else if ( AllowHTML && match( line, /^(<!--([^-]|-[^-]|--[^>])*-->|<\?([^\?]|\?[^>])*\?>|<![A-Z][^>]*>|<!\[CDATA\[([^\]]|\][^\]]|\]\][^>])*\]\]>|<\/[A-Za-z][A-Za-z0-9-]*[[:space:]]*>|<[A-Za-z][A-Za-z0-9-]*([[:space:]]+[A-Za-z_:][A-Za-z0-9_\.:-]*([[:space:]]*=[[:space:]]*([[:space:]"'=<>`]+|"[^"]*"|'[^']*'))?)*[[:space:]]*\/?>)/) ) {
     len = RLENGTH;
@@ -274,11 +279,6 @@ function _block( block, LOCAL, st, len, hlvl, htxt, guard, code, indent ) {
   } else if ( AllowHTML && match( block, /^ ? ? ?(<\/[A-Za-z][A-Za-z0-9-]*[[:space:]]*>|<[A-Za-z][A-Za-z0-9-]*([[:space:]]+[A-Za-z_:][A-Za-z0-9_\.:-]*([[:space:]]*=[[:space:]]*([[:space:]"'=<>`]+|"[^"]*"|'[^']*'))?)*[[:space:]]*\/?>)([[:space:]]*\n)([^\n]|\n[ \t]*[^\n])*(\n[[:space:]]*\n|$)/) ) {
     len = RLENGTH; st = RSTART;
     return substr(block, st, len) _block(substr(block, st + len));
-
-  # Horizontal rule
-  } else if ( match( block, /(^|\n) ? ? ?((\* *){3,}|(- *){3,}|(_ *){3,})($|\n)/) ) {
-    len = RLENGTH; st = RSTART;
-    return _block(substr(block, 1, st - 1)) "<hr />\n" _block(substr(block, st + len));
  
   # Blockquote (leading >)
   } else if ( match( block, /^> /) ) {
@@ -369,6 +369,11 @@ function _block( block, LOCAL, st, len, hlvl, htxt, guard, code, indent ) {
     return "<h" hlvl " id=\"" hid " - " HTML(htxt) "\">" inline( htxt ) "</h" hlvl ">\n\n" \
            _block( substr( block, len + 1) );
 
+  # Horizontal rule
+  } else if ( match( block, /(^|\n) ? ? ?((\* *){3,}|(- *){3,}|(_ *){3,})($|\n)/) ) {
+    len = RLENGTH; st = RSTART;
+    return _block(substr(block, 1, st - 1)) "<hr />\n" _block(substr(block, st + len));
+
   # Plain paragraph
   } else {
     match( block, /(^|\n)[[:space:]]*(\n|$)/ ) || match( block, /$/ );