From 4a73c7164a28728de0b717e869704c803ef9ca65 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Paul=20H=C3=A4nsch?= Date: Mon, 8 Jun 2020 15:36:40 +0200 Subject: [PATCH] limit escaping to necessary characters, more readable output, much faster escaping functions --- cgilite.sh | 51 +++++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 24 deletions(-) diff --git a/cgilite.sh b/cgilite.sh index 86ad280..b7067a7 100755 --- a/cgilite.sh +++ b/cgilite.sh @@ -187,35 +187,38 @@ COOKIE(){ } HTML(){ - # HTML Entity Coding - # Prints UTF-8 string as decimal Unicode Code Points - # Useful for escaping user input for use in HTML text and attributes - { [ $# -eq 0 ] && cat || printf %s "$*"; } \ - | hexdump -ve '/1 "%03o\n"' \ - | while read n; do - case $n in - # bitbanging octal UTF-8 chains into singular 7 digit octal numbers - [01]??) printf '0000%s' $n;; # 7 bit ASCII character, nothing to do - 2??) printf '%s' ${n#2};; # tail fragment, append 6 bit - 3[0123]?) printf '000%s' ${n#3};; # 2 octet (11 bit) chain start - 34?) printf '00%s' ${n#34};; # 3 octet (16 bit) chain start - 35?) printf '01%s' ${n#35};; # 3 octet chain start, high - 36?) printf '%s' ${n#36};; # 4 octet (21 bit) chain start + local str out + [ $# -eq 0 ] && str="$(cat)" || str="$*" + while [ "$str" ]; do + case $str in + \&*) out="${out}&";; + \<*) out="${out}<";; + \>*) out="${out}>";; + \"*) out="${out}"";; + \'*) out="${out}'";; + *) out="${out}${str%"${str#?}"}";; esac - done \ - | sed -E 's;.{7};&\n;g;' \ - | while read n; do - printf '&#%d;' $((0$n)) + str="${str#?}" done + printf %s "$out" } URL(){ - # Code every character in URL escape hex format - # except alphanumeric ascii - - { [ $# -eq 0 ] && cat || printf %s "$*"; } \ - | hexdump -v -e '/1 ",%02X"' \ - | sed 's;,;%;g; s;%2F;/;g;' + local str out + [ $# -eq 0 ] && str="$(cat)" || str="$*" + while [ "$str" ]; do + case $str in + \&*) out="${out}%26";; + \"*) out="${out}%22";; + \'*) out="${out}%27";; + \?*) out="${out}%3F";; + \#*) out="${out}%23";; + %*) out="${out}%25";; + *) out="${out}${str%"${str#?}"}";; + esac + str="${str#?}" + done + printf %s "$out" } SET_COOKIE(){ -- 2.39.2