Anubis / Xlib

Commit 2437881160b109715cf5c0ee4e873cc4ecdab784

Authored by David RENÉ
1 parent fa3d214c

clean up the dead code 

Security review of the html content. Now add encode_HTML_entities and to_JS_String protect it against the malicious string from user
Showing 7 changed files with 105 additions and 517 deletions   Show diff stats
Inline Side-by-side
web/jQuery/jq_dialog.anubis
  Show/Hide comments   View file @2437881
... ... @@ -154,7 +154,7 @@ public define String
154 154 WEB_Action_Name action,
155 155 List((String,String)) extra_ops
156 156 )=
157   - "Xlib.jq_dialog_load('"+id(dialog_id)+"',"+format_web_action_name_to_js(action, extra_ops)+");"
  157 + "Xlib.jq_dialog_load("+to_JS_String(id(dialog_id))+", "+format_web_action_name_to_js(action, extra_ops)+");"
158 158 .
159 159  
160 160  
... ...
web/jQuery/jq_form.anubis
  Show/Hide comments   View file @2437881
... ... @@ -33,6 +33,6 @@ public define String
33 33 )=
34 34 with dialog_id_str = if length(dialog_id) > 0 then ", '" + dialog_id + "'" else "",
35 35 with call_back_str = if length(call_back) > 0 then ", "+call_back else "",
36   - with url = format_web_action_name(action, extra_ops),
37   - "Xlib.jq_form_submit_and_close('" + form_id + "', '" + url + "'"+dialog_id_str+call_back_str+");"
  36 + with url = format_web_action_name_to_js(action, extra_ops),
  37 + "Xlib.jq_form_submit_and_close(" + to_JS_String(form_id) + ", " + url + dialog_id_str+call_back_str+");"
38 38 .
... ...
web/jquery.anubis
  Show/Hide comments   View file @2437881
... ... @@ -10,6 +10,7 @@ transmit xlib/web/making_a_web_site.anubis
10 10 read xlib/web/load_content.anubis
11 11 read tools/printable_tree.anubis
12 12 read tools/basis.anubis
  13 +read xlib/web/js_tools.anubis
13 14  
14 15 /* jQuery Actioner type */
15 16 public type JQuery_Actioner_type:
... ... @@ -92,7 +93,7 @@ public define String
92 93 }+
93 94 "$('#"+form+"').submit();\n",
94 95 jqformload(form_id, target_id, web_action, extra_args) then
95   - "Xlib.jq_form_submit_and_load('"+form_id+"', '"+format_web_action_name(web_action, extra_args)+"', '"+target_id+"');\n"
  96 + "Xlib.jq_form_submit_and_load("+to_JS_String(form_id)+", "+format_web_action_name_to_js(web_action, extra_args)+", "+to_JS_String(target_id)+");\n"
96 97 jqlink(control_action, extra_ops) then
97 98 if control_action is
98 99 {
... ... @@ -121,7 +122,7 @@ public define String
121 122 }+
122 123 "$('#"+form+"').submit();\n",
123 124 jqformload(form_id, target_id, web_action, extra_args) then
124   - "Xlib.jq_form_submit_and_load('"+form_id+"', '"+format_web_action_name(web_action, extra_args)+"', '"+target_id+"');\n"
  125 + "Xlib.jq_form_submit_and_load("+to_JS_String(form_id)+", "+format_web_action_name_to_js(web_action, extra_args)+", "+to_JS_String(target_id)+");\n"
125 126 jqlink(control_action, extra_ops) then
126 127 if control_action is
127 128 {
... ... @@ -150,7 +151,7 @@ public define String
150 151 }+
151 152 "$('#"+form+"').submit();\n",
152 153 jqformload(form_id, target_id, web_action, extra_args) then
153   - "Xlib.jq_form_submit_and_load('"+form_id+"', '"+format_web_action_name(web_action, extra_args)+"', '"+target_id+"');\n"
  154 + "Xlib.jq_form_submit_and_load("+to_JS_String(form_id)+", "+format_web_action_name_to_js(web_action, extra_args)+", "+to_JS_String(target_id)+");\n"
154 155 jqlink(control_action, extra_ops) then
155 156 if control_action is
156 157 {
... ...
web/load_content.anubis
  Show/Hide comments   View file @2437881
... ... @@ -18,7 +18,7 @@ public define String
18 18 WEB_Action_Name web_action,
19 19 List((String,String)) extra_args
20 20 )=
21   - "window.open('"+format_web_action_name(web_action, extra_args)+"', '_blank', 'location=0');"
  21 + "window.open("+format_web_action_name_to_js(web_action, extra_args)+", '_blank', 'location=0');"
22 22 .
23 23  
24 24 public define String
... ... @@ -27,7 +27,7 @@ public define String
27 27 WEB_Action_Name web_action,
28 28 List((String,String)) extra_args
29 29 )=
30   - "window.open('"+format_web_action_name(web_action, extra_args)+"', '_blank');"
  30 + "window.open("+format_web_action_name_to_js(web_action, extra_args)+", '_blank');"
31 31 .
32 32  
33 33 public define String
... ... @@ -36,7 +36,7 @@ public define String
36 36 WEB_Action_Name web_action,
37 37 List((String,String)) extra_args
38 38 )=
39   - "location.href='"+format_web_action_name(web_action, extra_args)+"'"
  39 + "location.href="+format_web_action_name_to_js(web_action, extra_args)
40 40 .
41 41  
42 42 public define String
... ... @@ -67,7 +67,7 @@ public define String
67 67 Bool overlay
68 68 )=
69 69  
70   - "Xlib.load_content('"+target+"', '"+format_web_action_name(web_action, extra_args)+"', "+to_String(replace)+", "+to_String(replace)+");"
  70 + "Xlib.load_content('"+target+"', "+format_web_action_name_to_js(web_action, extra_args)+", "+to_String(replace)+", "+to_String(overlay)+");"
71 71 .
72 72  
73 73 public define String
... ... @@ -79,7 +79,7 @@ public define String
79 79 Bool replace,
80 80 Bool overlay
81 81 )=
82   - to_JS_String("Xlib.load_content('"+target+"', "+format_web_action_name_to_js(web_action, extra_args)+", "+to_String(replace)+", "+to_String(replace)+")")
  82 + to_JS_String("Xlib.load_content("+to_JS_String(target)+", "+format_web_action_name_to_js(web_action, extra_args)+", "+to_String(replace)+", "+to_String(overlay)+")")
83 83 .
84 84  
85 85 public define String
... ... @@ -184,5 +184,5 @@ public define String
184 184 List((String,String)) extra_args
185 185 )=
186 186  
187   - "Xlib.load_to_clipboard('"+format_web_action_name(web_action, extra_args)+"');"
  187 + "Xlib.load_to_clipboard("+format_web_action_name_to_js(web_action, extra_args)+");"
188 188 .
... ...
web/making_a_web_site.anubis
  Show/Hide comments   View file @2437881
... ... @@ -62,6 +62,7 @@ read web/mime.anubis
62 62  
63 63 read xlib/web/cookies.anubis
64 64 read xlib/web/json.anubis
  65 +transmit xlib/web/js_tools.anubis
65 66 transmit xlib/web/web_dump.anubis
66 67 transmit xlib/web/web_arg_utils.anubis
67 68 transmit xlib/web/web_session.anubis
... ... @@ -771,6 +772,35 @@ public define String
771 772  
772 773 //public define Table_Option nude = border(0,0,0,rgb(0,0,0)).
773 774  
  775 +public define String
  776 + to_String
  777 + (
  778 + Link_attr attr
  779 + )=
  780 + if attr is
  781 + {
  782 + crossorigin(c_origin) then "crossorigin=\""+to_String(c_origin)+"\"",
  783 + href(url) then "href=\""+encode_HTML_entities(url)+"\"",
  784 + media(media) then "media=\""+encode_HTML_entities(media)+"\"",
  785 + referrerpolicy(r_policy) then "referrerpolicy=\""+to_String(r_policy)+"\"",
  786 + rel(rel_attr) then "rel=\""+to_String(rel_attr)+"\"",
  787 + sizes(_sizes) then "sizes=\""+encode_HTML_entities(_sizes)+"\"",
  788 + type(_type) then "type=\""+encode_HTML_entities(_type)+"\"",
  789 + as(_as) then "as=\""+encode_HTML_entities(_as)+"\"",
  790 + integrity(_integrity) then "integrity=\""+encode_HTML_entities(_integrity)+"\"",
  791 + event(_event, code) then to_String(_event)+"=\""+encode_HTML_entities(code)+"\"",
  792 + }
  793 +.
  794 +
  795 +public define String
  796 + to_String
  797 + (
  798 + List(Link_attr) attrs
  799 + )=
  800 + join(" ", map((Link_attr attr) |->
  801 + to_String(attr),
  802 + attrs))
  803 +.
774 804  
775 805  
776 806 public define Actioner_Aspect
... ... @@ -2097,28 +2127,7 @@ public define HTML
2097 2127 up to the value of the parameter $T), which correspond to elements which may be put
2098 2128 anywhere in the page.
2099 2129  
2100   -//public define HTML
2101   -// partial_content
2102   -// (
2103   -// List(HTML_Head_Tag) tags,
2104   -// List(HTML) content
2105   -// )=
2106   -// partial_content(tags, sequence(content)).
2107   -//
2108   -//public define HTML
2109   -// partial_content
2110   -// (
2111   -// HTML content
2112   -// )=
2113   -// partial_content([], content).
2114   -//
2115   -//public define HTML
2116   -// partial_content
2117   -// (
2118   -// List(HTML) content
2119   -// )=
2120   -// partial_content([], sequence(content)).
2121   -//
  2130 +
2122 2131 public define HTML
2123 2132 add_partial_content
2124 2133 (
... ... @@ -2128,7 +2137,7 @@ public define HTML
2128 2137 if p_content is partial_content(_partial_content, html) then
2129 2138 partial_content(tags + _partial_content, html)
2130 2139 else
2131   - p_content
  2140 + partial_content(tags, [p_content])
2132 2141 .
2133 2142  
2134 2143 define HTML
... ... @@ -2148,47 +2157,7 @@ define HTML
2148 2157 else
2149 2158 list_to_pcontent(t, so_far_tags, [h . so_far_html])
2150 2159 }.
2151   -
2152   -//public define HTML
2153   -// partial_content
2154   -// (
2155   -// List(HTML) l_p_content
2156   -// )=
2157   -// list_to_pcontent(l_p_content, [], []).
2158   -//
2159   -//public define HTML
2160   -// partial_empty
2161   -// =
2162   -// partial_content(empty)
2163   -//.
2164   -
2165   - define String
2166   - format
2167   - (
2168   - List(Text_Option) l
2169   - ).
2170   -
2171   - define Printable_tree
2172   - format_css_styles
2173   - (
2174   - List(CSS_Style) l
2175   - ) =
2176   - if l is
2177   - {
2178   - [ ] then [ ],
2179   - [h . t] then
2180   - [ if h is
2181   - {
2182   - text_options(tos) then
2183   - [" body, span, p { ", format(tos), " }\n" ]
2184   - }
2185   - . format_css_styles(t)]
2186   - }.
2187   -
2188   -
2189   -
2190   -
2191   -
  2160 +
2192 2161 Meta tags are put in the 'head' of the HTML page.
2193 2162  
2194 2163 public define HTML_Meta
... ... @@ -2223,12 +2192,6 @@ public define HTTP_Answer
2223 2192 [], // list of 'META' tags (empty for this site)
2224 2193 body // body of page
2225 2194 (
2226   - // list of body options
2227   - [
2228   - //background_color(rgb(255,200,200))
2229   - // add more body options here
2230   - ],
2231   -
2232 2195 // content of page
2233 2196 text(name+" Controller error")
2234 2197 )
... ... @@ -2238,9 +2201,6 @@ public define HTTP_Answer
2238 2201  
2239 2202 'HTTP_Answer' represents the final product of the construction of a web page.
2240 2203  
2241   -
2242   -
2243   -
2244 2204 *** (3.2) ``in form'' versus ``off form''.
2245 2205  
2246 2206 There is a variety of HTML elements: texts, buttons, links, forms, inputs, etc... Some
... ... @@ -3131,48 +3091,7 @@ define String
3131 3091 }
3132 3092 .
3133 3093  
3134   -// Compatibility function for older websites
3135   - public define Web_Site
3136   - make_web_site_description
3137   - (
3138   - List(String) common_names, // for example: ["www.our-business.com"]
3139   - String site_directory,
3140   - String state_directory,
3141   - One -> One init,
3142   - (HTTP_Info,
3143   - List(Web_arg),
3144   - Bool is_https) -> $State initial_state,
3145   - ($State expired,
3146   - Maybe(String),
3147   - HTTP_Info,
3148   - List(Web_arg),
3149   - Bool is_https) -> $State ticket_expired_state,
3150   - (Maybe(String),
3151   - HTTP_Info,
3152   - List(Web_arg),
3153   - Bool is_https) -> $State ticket_lost_state,
3154   - List(Web_Action($State)) actions,
3155   - $State -> HTTP_Answer compute_page,
3156   - $State -> List(HTTP_header) additional_headers,
3157   - List(HTTP_header) constant_additional_headers,
3158   - Int timeout,
3159   - Redirections redirections,
3160   - String charset,
3161   - List(String) journal_extensions,
3162   - List(String) journal_headers,
3163   - (LogLevel, String) -> One logger, //logger
3164   - String secret,
3165   - List(MIME) known_mime_types,
3166   - (String action_name,
3167   - List(Web_arg) args) -> One before_send_file
3168   - //Bool using_state_cookies
3169   - )
3170   - =
3171   - //generate an unique ID if doesn't exist in root of site_directory
3172   - with site_UID = get_site_uid(site_directory, logger),
3173   - make_web_site_description(site_UID, common_names, site_directory, state_directory, init, initial_state, ticket_expired_state, ticket_lost_state, actions, compute_page, additional_headers, constant_additional_headers, timeout, redirections, charset, journal_extensions, journal_headers, logger, secret, known_mime_types, before_send_file)
3174   -.
3175   -
  3094 +
3176 3095  
3177 3096  
3178 3097 *** [4.3] Starting the servers.
... ... @@ -3274,48 +3193,6 @@ public define One
3274 3193 implicitly to the form containing it. The name of that form is transmitted to the
3275 3194 'format' functions called from within the formating of that form.
3276 3195  
3277   -
3278   -
3279   -
3280   - *** [5.1] The type 'HTML_Any($T)'.
3281   -
3282   - The type 'HTML_Any($T)' gathers elements which may be put anywhere in the page. The
3283   - parameter $T becomes either 'HTML' or 'HTML_In_Form'.
3284   -
3285   - type HTML_Any($T):
3286   - any_text (List(CoreAttrs), String the_text),
3287   - any_preformated (List(CoreAttrs), String),
3288   - any_paragraph (List(CoreAttrs), List($T) content),
3289   - //any_image (List(CoreAttrs), String url, String alternate),
3290   - //any_image (List(CoreAttrs), String url, String alternate, Int width, Int height),
3291   - //any_center ($T),
3292   - //any_mail_to (String email, $T element),
3293   - any_fixed_size (HTML_Size width, HTML_Size height, $T content),
3294   - any_fixed_size_2 (HTML_Size width, HTML_Size height, String name_of_HTML_file),
3295   - any_actioner (Actioner_Connection,
3296   - Actioner_Target,
3297   - Actioner_Aspect,
3298   - WEB_Action_Name action,
3299   - List((String,String)) extra_ops,
3300   - List(Actioner_Local_Action),
3301   - Maybe(String) form_name),
3302   - any_foreign_link_new (Actioner_Target, Actioner_Aspect, String url),
3303   - any_foreign_link (List(CoreAttrs), String url),
3304   - any_foreign_link (List(CoreAttrs), String url, String name),
3305   - any_private_download (String abs_path, String name, String extra_ext,
3306   - Maybe((String,List((String,String))))),
3307   - any_div (List(CoreAttrs), List($T) element),
3308   - any_div_empty (List(CoreAttrs)),
3309   - any_coreattrs (List(CoreAttrs)),
3310   - any_ol (List(CoreAttrs), List($T) content),
3311   - any_ul (List(CoreAttrs), List($T) content),
3312   - any_li (List(CoreAttrs), List($T) content),
3313   - any_button (List(CoreAttrs), List($T) element),
3314   - any_i (List(CoreAttrs), String text),
3315   - any_span (List(CoreAttrs), String text),
3316   - any_hr (List(CoreAttrs))
3317   -.
3318   -
3319 3196  
3320 3197  
3321 3198 *** [5.2] Formating a color.
... ... @@ -3375,22 +3252,6 @@ define RGBA
3375 3252 Each extra operand is a pair of strings: (name,value). It is formated as:
3376 3253  
3377 3254 &oname=value
3378   -
3379   -
3380   -
3381   -//public define String
3382   -// format_extra_operands
3383   -// (
3384   -// List((String,String)) l
3385   -// ) =
3386   -// if l is
3387   -// {
3388   -// [ ] then "",
3389   -// [h . t] then if h is (n,v) then
3390   -// "&"+n+"="+v+format_extra_operands(t)
3391   -// }
3392   -//.
3393   -
3394 3255  
3395 3256 It seams that the standard requires "&" instead of "&" !
3396 3257  
... ... @@ -3434,30 +3295,6 @@ define Int
3434 3295 The next function composes the URL. It is a JavaScript URL when the target is another
3435 3296 window.
3436 3297  
3437   -//public define String
3438   -// format_web_action_name
3439   -// (
3440   -// WEB_Action_Name action
3441   -// )=
3442   -// if action is
3443   -// {
3444   -// no_action then "",
3445   -// controller_action(controller, action_name) then "?aws_controller="+controller+"&aws_action="+action_name,
3446   -// action_name(action_name) then "?aws_action="+action_name,
3447   -// url(url) then url
3448   -// }
3449   -//.
3450   -//
3451   -//public define String
3452   -// format_web_action_name
3453   -// (
3454   -// WEB_Action_Name action,
3455   -// List((String,String)) extra_ops,
3456   -// )=
3457   -// format_web_action_name(action)
3458   -// +
3459   -// format_extra_operands(extra_ops)
3460   -//.
3461 3298  
3462 3299 define String
3463 3300 make_actioner_url
... ... @@ -3490,7 +3327,7 @@ define String
3490 3327 if target is
3491 3328 {
3492 3329 same then strict_url,
3493   - same(label) then strict_url+"#"+label,
  3330 + same(label) then strict_url+"#"+encode_HTML_entities(label),
3494 3331 other(wn,ops) then
3495 3332  
3496 3333 "javascript:void window.open('"+strict_url+"&t="+wn+"','"+
... ... @@ -3506,10 +3343,10 @@ define String
3506 3343 if target is
3507 3344 {
3508 3345 same then "/",
3509   - same(label) then "/#"+label,
  3346 + same(label) then "/#"+encode_HTML_entities(label),
3510 3347 other(wn,ops) then
3511 3348  
3512   - "javascript:void window.open('"+url+"','"+
  3349 + "javascript:void window.open("+to_JS_String(url)+",'"+
3513 3350 "w"+to_ascii(sha1(wn))+"','"+format(ops)+"')"
3514 3351 }.
3515 3352  
... ... @@ -3566,76 +3403,6 @@ define URL_or_JavaScript
3566 3403  
3567 3404 Now, we format the actioner according to its aspect.
3568 3405  
3569   -//define List(Text_Option)
3570   -// get_text_options
3571   -// (
3572   -// List(Text_Option) l
3573   -// )
3574   -// =
3575   -// if l is
3576   -// {
3577   -// [] then [],
3578   -// [h . t ] then
3579   -// if h is class(_) then
3580   -// get_text_options(t)
3581   -// else if h is id(_) then
3582   -// get_text_options(t)
3583   -// else if h is style(_) then
3584   -// get_text_options(t)
3585   -// else if h is title(_) then
3586   -// get_text_options(t)
3587   -// else if h is core_attrs(_) then
3588   -// get_text_options(t)
3589   -// else
3590   -// [ h . get_text_options(t) ]
3591   -//
3592   -// }.
3593   -//
3594   - /**
3595   - * Extract the CSS class list from the list of Text_Option
3596   - */
3597   -//define List(CoreAttrs)
3598   -// get_css_class
3599   -// (
3600   -// List(Text_Option) l
3601   -// )
3602   -// =
3603   -// if l is
3604   -// {
3605   -// [] then [],
3606   -// [h . t ] then
3607   -// if h is class(name) then
3608   -// [ class(name) . get_css_class(t) ]
3609   -// else if h is id(name) then
3610   -// [ id(name) . get_css_class(t) ]
3611   -// else if h is style(the_style) then
3612   -// [ style(the_style) . get_css_class(t) ]
3613   -// else if h is title(name) then
3614   -// [ tooltip(name) . get_css_class(t) ]
3615   -// else if h is attr(name, value) then
3616   -// [ attr(name, value) . get_css_class(t) ]
3617   -// else
3618   -// get_css_class(t)
3619   -// }
3620   -//.
3621   -
3622   -
3623   -//define List(CoreAttrs)
3624   -// get_core_attrs
3625   -// (
3626   -// List(Text_Option) l
3627   -// )
3628   -// =
3629   -// if l is
3630   -// {
3631   -// [] then [],
3632   -// [h . t ] then
3633   -// if h is core_attrs(attrs) then
3634   -// attrs + get_core_attrs(t)
3635   -// else
3636   -// get_core_attrs(t)
3637   -// }
3638   -// .
3639 3406  
3640 3407 define Printable_tree
3641 3408 format
... ... @@ -3652,55 +3419,6 @@ define Printable_tree
3652 3419 . format(t)]
3653 3420 }.
3654 3421  
3655   -
3656   -//define String
3657   -// format_attrs
3658   -// (
3659   -// List(InputAttrs) attributs,
3660   -// List(String) classes,
3661   -// List(String) styles
3662   -// )=
3663   -// if attributs is
3664   -// {
3665   -// [] then
3666   -// if length(classes) = 0 then "" else " class=\""+join(" ",classes)+"\""+
3667   -// if length(styles) = 0 then "" else " style=\""+join(";",styles)+"\"",
3668   -// [h . t] then
3669   -// with new_classes = if h is class(class_name) then [class_name. classes] else classes,
3670   -// new_styles = if h is style(style_string) then [style_string . styles] else styles,
3671   -// current = if h is
3672   -// {
3673   -// id(id_name) then
3674   -// " id=\"" + id_name + "\"",
3675   -// class(class_name) then "",
3676   -// style(style_string) then "",
3677   -// title(title_string) then
3678   -// " title=\"" + title_string + "\"",
3679   -//
3680   -// lang(lang) then
3681   -// " xml:lang=" + lang,
3682   -// dir(reading_Way) then
3683   -// if reading_Way is
3684   -// {
3685   -// ltr then " dir=ltr",
3686   -// rtl then " dir=rtl"
3687   -// },
3688   -//
3689   -// accesskey(key) then
3690   -// " accesskey=\"" + key + "\"",
3691   -// tabindex(index) then
3692   -// " tabindex=\"" + index + "\"",
3693   -//
3694   -// attr(name, value) then
3695   -// " " + name + "=\"" + value + "\"",
3696   -//
3697   -// event(e, value) then
3698   -// " " + event_name(e) + "=\"" + value + "\"",
3699   -// data(name, value) then
3700   -// " data-" + to_lower(name) + "=\"" + value + "\"",
3701   -// },
3702   -// current + format_attrs(t, classes, styles)
3703   -// }.
3704 3422  
3705 3423 public define List(CoreAttrs) extract_attributes(HTML_tooltip htt).
3706 3424  
... ... @@ -3715,8 +3433,8 @@ define String
3715 3433 {
3716 3434 [] then
3717 3435 //concat all accumulated classes and styles
3718   - (if length(classes) = 0 then "" else " class=\""+join(" ",classes)+"\"")+
3719   - if length(styles) = 0 then "" else " style=\""+join(";",styles)+"\"",
  3436 + (if length(classes) = 0 then "" else " class=\""+encode_HTML_entities(join(" ",classes))+"\"")+
  3437 + if length(styles) = 0 then "" else " style=\""+encode_HTML_entities(join(";",styles))+"\"",
3720 3438 [h . t] then
3721 3439 with new_classes = if h is class(class_name) then [class_name. classes] else classes,
3722 3440 new_styles = if h is style(style_string) then [style_string . styles] else styles,
... ... @@ -3726,14 +3444,14 @@ define String
3726 3444 {
3727 3445 empty_attr then "",
3728 3446 id(id_name) then
3729   - " id=\"" + id_name + "\"",
  3447 + " id=\"" + encode_HTML_entities(id_name) + "\"",
3730 3448 class(class_name) then "", //do nothing here, because we accumulate the class until we have some other attributes
3731 3449 style(style_string) then "", //do nothing here, because we accumulate the style until we have some other attributes
3732 3450 title(title_string) then
3733   - " title=\"" + title_string + "\"",
  3451 + " title=\"" + encode_HTML_entities(title_string) + "\"",
3734 3452  
3735 3453 lang(lang) then
3736   - " xml:lang=" + lang,
  3454 + " xml:lang=\"" + encode_HTML_entities(lang) + "\"",
3737 3455 dir(reading_Way) then
3738 3456 if reading_Way is
3739 3457 {
... ... @@ -3746,26 +3464,26 @@ define String
3746 3464 tabindex(index) then
3747 3465 " tabindex=\"" + index + "\"",
3748 3466 attr(name, value) then
3749   - " " + name + "=\"" + value + "\"",
  3467 + " " + name + "=\"" + encode_HTML_entities(value) + "\"",
3750 3468 bool_attr(bool, value)then
3751 3469 if bool then " "+value+" " else "",
3752 3470 event(e, value) then
3753   - " " + event_name(e) + "=\"" + value + "\"",
  3471 + " " + event_name(e) + "=\"" + encode_HTML_entities(value) + "\"",
3754 3472 tooltip(_) then "", //do nothing here, because we extract attributes at first in new_attrs
3755 3473 data(name, value) then
3756   - " data-" + to_lower(name) + "=\"" + value + "\"",
  3474 + " data-" + to_lower(name) + "=\"" + encode_HTML_entities(value) + "\"",
3757 3475  
3758 3476 contenteditable(value)then //boolean value
3759 3477 " contenteditable=\""+ to_String(value)+ "\""
3760 3478  
3761 3479 contextmenu(id_name) then //ID value
3762   - " contextmenu=\"" + id_name + "\"",
  3480 + " contextmenu=\"" + encode_HTML_entities(id_name) + "\"",
3763 3481  
3764 3482 draggable(value) then //boolean value
3765 3483 " draggable=\""+ to_String(value)+ "\"",
3766 3484  
3767 3485 enterkeyhint(value) then
3768   - " enterkeyhint=\""+ value + "\"",
  3486 + " enterkeyhint=\""+ encode_HTML_entities(value) + "\"",
3769 3487  
3770 3488 hidden(value) then //boolean value
3771 3489 " hidden=\""+ (if value then "hidden" else "") + "\"",
... ... @@ -3774,7 +3492,7 @@ define String
3774 3492 " inert",
3775 3493  
3776 3494 inputmode(value) then
3777   - " inputmode =\"" + value + "\"",
  3495 + " inputmode =\"" + encode_HTML_entities(value) + "\"",
3778 3496  
3779 3497 popover then
3780 3498 " popover",
... ... @@ -3873,7 +3591,7 @@ define Printable_tree
3873 3591 img_link(opt, img, alt_text) then
3874 3592 [
3875 3593 "<a href=\"", full_url ,"\"", format_attrs(opt),"><img src=\"", img,
3876   - "\" alt=\"" + alt_text + "\" border=\"0\"></a>"
  3594 + "\" alt=\"" + encode_HTML_entities(alt_text) + "\" border=\"0\"></a>"
3877 3595 ],
3878 3596 push_button(options, text) then
3879 3597 ["<a href=\"",full_url,"\"", format_attrs(options), ">",
... ... @@ -3952,12 +3670,12 @@ define Printable_tree
3952 3670 if action_name ="" then
3953 3671 [
3954 3672 "<img src=\"", img,"\"",
3955   - format_attrs(options)," alt=\"" + alt_text + "\" border=\"0\">"
  3673 + format_attrs(options)," alt=\"" + encode_HTML_entities(alt_text) + "\" border=\"0\">"
3956 3674 ]
3957 3675 else
3958 3676 [
3959 3677 "<a href=\"", url,"\"", format_attrs(options),"><img src=\"", img,
3960   - "\" alt=\"" + alt_text + "\" border=\"0\"></a>"
  3678 + "\" alt=\"" + encode_HTML_entities(alt_text) + "\" border=\"0\"></a>"
3961 3679 ],
3962 3680 push_button(options, text) then
3963 3681 [
... ... @@ -4092,13 +3810,6 @@ define Printable_tree
4092 3810  
4093 3811 *** [5.6] Formating rows and cells in a table.
4094 3812  
4095   -//define Int
4096   -// percent
4097   -// (
4098   -// Int p
4099   -// ) =
4100   -// if p < 0 then 0 else if p > 100 then 100 else p.
4101   -
4102 3813  
4103 3814 define Printable_tree
4104 3815 format_scroller
... ... @@ -4204,59 +3915,6 @@ define Printable_tree
4204 3915 }.
4205 3916  
4206 3917  
4207   - // The function below formats a datum of type 'HTML_Any($T)'.
4208   -
4209   - define Printable_tree
4210   - format
4211   - (
4212   - CommonInfo cinfo,
4213   - Var(Int) ic_v,
4214   - HTML_Any($T) element,
4215   - $T -> Printable_tree format_element, // able to format a datum of type $T
4216   - Bool is_https,
4217   - Var(Int) action_count,
4218   - Var(List(HTML_Head_Tag)) partial_content
4219   - ) =
4220   - if cinfo is info(common_name,http_port,https_port,site_directory,secret) then
4221   - if element is
4222   - {
4223   -
4224   - any_foreign_link_new(target, aspect, url) then
4225   - format_foreign_link(target, aspect, url, is_https, cinfo, action_count, ic_v, partial_content),
4226   -
4227   - any_foreign_link(options,url) then
4228   - ["<a href=\"",url,"\" ", format_attrs(options), "></a>"], // IE7 doesn't support the form <a href="..." />
4229   - any_foreign_link(options,url,name) then
4230   - ["<a href=\"",url,"\"><span ", format_attrs(options), ">",name,"</span></a>"],
4231   - any_private_download(url,name,extra_ext,action) then
4232   - format_private_download(cinfo,url,name,extra_ext,action),
4233   - any_div(options, l) then
4234   - [format_div_option(options), flat(map(($T e) |-> format_element(e), l)),"</div>\n"],
4235   - any_div_empty(options) then
4236   - [format_div_option(options), "</div>\n"],
4237   - any_coreattrs(attributs) then
4238   - [format_attrs(attributs)],
4239   - any_ol(opts, l) then
4240   - ["<ol", format_attrs(opts), ">", flat(map(($T e) |-> format_element(e), l)),"</ol>\n"],
4241   - any_ul(opts, l) then
4242   - ["<ul", format_attrs(opts), ">", flat(map(($T e) |-> format_element(e), l)),"</ul>\n"],
4243   - any_li(opts, l) then
4244   - ["<li", format_attrs(opts), ">", flat(map(($T e) |-> format_element(e), l)),"</li>\n"],
4245   - any_button(options, l) then
4246   - [["<button" + format_attrs(options) + ">"], flat(map(($T e) |-> format_element(e), l)),"</button>\n"],
4247   - any_i(opts,t) then
4248   - if t = "" then
4249   - ["<i", format_attrs(opts), "></i>\n"]
4250   - else
4251   - ["<i", format_attrs(opts), ">",t,"</i>\n"],
4252   - any_span(opts , t) then
4253   - ["<span", format_attrs(opts), ">",t,"</span>"]
4254   - any_hr(opts) then
4255   - ["<hr", format_attrs(opts),">"]
4256   - }
4257   -.
4258   -
4259   -
4260 3918  
4261 3919 // *** [5.8] Formating 'in form' elements.
4262 3920  
... ... @@ -4435,8 +4093,8 @@ define Printable_tree
4435 4093 )=
4436 4094 if _href is
4437 4095 {
4438   - href(str) then if str = "" then [] else [" href=\"", str, "\""],
4439   - href(action, extra) then [" href=\"",format_web_action_name(action, extra), "\""]
  4096 + href(str) then if str = "" then [] else [" href=\"", encode_HTML_entities(str), "\""],
  4097 + href(action, extra) then [" href=\"",encode_HTML_entities(format_web_action_name(action, extra)), "\""]
4440 4098 }
4441 4099 .
4442 4100  
... ... @@ -4452,7 +4110,7 @@ define Printable_tree
4452 4110 _self then "_self",
4453 4111 _parent then "_parent",
4454 4112 _top then "_top",
4455   - framename(name) then name
  4113 + framename(name) then encode_HTML_entities(name)
4456 4114 },
4457 4115 "\""]
4458 4116 .
... ... @@ -4471,91 +4129,46 @@ define Printable_tree
4471 4129 define Printable_tree
4472 4130 format
4473 4131 (
4474   - CommonInfo cinfo,
4475   - Var(Int) ic_v, // 'idnum' counter variable
4476   - HTML element,
4477   - Bool is_https,
4478   - Var(Int) action_count,
4479   - Var(List(HTML_Head_Tag)) global_partial_content
  4132 + CommonInfo cinfo,
  4133 + Var(Int) ic_v, // 'idnum' counter variable
  4134 + HTML element,
  4135 + Bool is_https,
  4136 + Var(Int) action_count,
  4137 + Var(List(HTML_Head_Tag)) global_partial_content
4480 4138 ) =
4481   - if cinfo is info(common_name,http_port,https_port,site_directory,secret) then
4482   - with format_element = (HTML e) |-> format(cinfo, ic_v, e, is_https, action_count, global_partial_content),
  4139 + if cinfo is info(common_name,http_port,https_port,site_directory,secret) then
  4140 + with format_element = (HTML e) |-> format(cinfo, ic_v, e, is_https, action_count, global_partial_content),
4483 4141 if element is
4484 4142 {
4485   - a(opts, _href, _target, l) then ["<a ", format_attrs(opts), format_href(_href), format_target(_target), ">",flat(map(format_element,l)),"</a>\n"],
4486   - empty then [],
4487   - literal_pt(t) then t,
4488   - literal(t) then [t],
4489   - sequence(l) then flat(map(format_element,l)),
4490   - text(opts,t) then
4491   - if opts is
4492   - {
4493   - [] then [t],
4494   - [_ . _] then ["<span", format_attrs(opts), ">",t,"</span>"]
4495   - },
  4143 + a(opts, _href, _target, l) then ["<a ", format_attrs(opts), format_href(_href), format_target(_target), ">",flat(map(format_element,l)),"</a>\n"],
  4144 + empty then [],
  4145 + literal_pt(t) then t,
  4146 + literal(t) then [t],
  4147 + sequence(l) then flat(map(format_element,l)),
  4148 +
  4149 + text(opts, t) then
  4150 + if opts is
  4151 + {
  4152 + [] then [encode_HTML_entities(t)],
  4153 + [_ . _] then ["<span", format_attrs(opts), ">",encode_HTML_entities(t),"</span>"]
  4154 + },
4496 4155 actioner(c,t,a,an,eo,ja) then
4497   - //format(cinfo,ic_v,
4498 4156 format_actioner(cinfo,c,t,a,an,eo,ja,failure,is_https, action_count, ic_v, global_partial_content),
4499   - // is_https, action_count, partial_content),
4500 4157  
4501 4158 actioner(c,t,a,an,eo,ja,fn) then
4502   - //format(cinfo,ic_v,
4503 4159 format_actioner(cinfo,c,t,a,an,eo,ja,success(fn),is_https, action_count, ic_v, global_partial_content),
4504   - // format_element,is_https, action_count, partial_content),
4505 4160  
4506 4161 foreign_link_new(target, aspect, url) then
4507   - //format(cinfo,ic_v,
4508 4162 format_foreign_link(target, aspect, url, is_https, cinfo, action_count, ic_v, global_partial_content),
4509   - //format_element,is_https, action_count, partial_content),
4510 4163  
4511   -
4512   -// foreign_link(options,url,name) then
4513   -// format(cinfo,ic_v,any_foreign_link(options,url,name),format_element,is_https, action_count, partial_content),
4514 4164 private_download(url, name, extra, action) then
4515   - //format(cinfo,ic_v,
4516   - format_private_download(cinfo, url, name, extra, action),
4517   - //format_element,is_https, action_count, partial_content),
4518   -
4519   -// div(options, p_content) then
4520   -// with html_elements = map((HTML pc) |->
4521   -// since pc is partial_content(tags, html_elem),
4522   -// partial_content <- *partial_content + tags; //accumulate the tags
4523   -// html_elem, //return the HTML element
4524   -// p_content),
4525   -//
4526   -// //format(cinfo, ic_v,
4527   -
4528   -// [format_div_option(options), flat(map((HTML e) |-> format_element(e), html_elements)),"</div>\n"],
4529   - //format_element, is_https, action_count, partial_content),
4530   -// iframe(options, css_styles, css_files, js_files, body) then
4531   -// println("formating iframe");
4532   -// if body is body(body_options,elem) then
4533   -// [ "<iframe", format_attrs(options), " srcdoc=\"\n",
4534   -//
4535   -// encode_HTML_quote(to_String([
4536   -// "<html style=\"margin: 0pt; padding: 0pt;\">\n",
4537   -// "<head>\n",
4538   -// //add_css_styles(css_styles),
4539   -// add_css_files(css_files),
4540   -// add_js_files(js_files),
4541   -// "</head>\n",
4542   -// "<body ", format_attrs(body_options), ">\n", // format body options
4543   -// format(cinfo,ic_v, elem ,is_https, action_count, partial_content),
4544   -// "</body>\n",
4545   -// "</html>\n",])),
4546   -//
4547   -// "\"></iframe>\n",
4548   -// ],
  4165 + format_private_download(cinfo, url, name, extra, action),
  4166 +
4549 4167 partial_content(_partial_content, html_elements) then
4550 4168 global_partial_content <- *global_partial_content + _partial_content; //accumulate the tags
4551   -// if p_content is partial_content(tags, html_elements) then
4552   -// partial_content <- *partial_content + tags;
4553   -// format(cinfo, ic_v, html_elements, is_https, action_count, partial_content),
4554 4169 flat(map(format_element, html_elements))
4555 4170  
4556   -
4557 4171 html_tag(tag_name, opts, l) then ["<",tag_name, format_attrs(opts), ">", flat(map(format_element,l)), "</",tag_name,">\n"],
4558   -// html_tag(tag_name, opts) then ["<",tag_name, format_attrs(opts), "></",tag_name,">\n"],
4559 4172 html_void_tag(tag_name, opts) then ["<",tag_name, format_attrs(opts), ">"],
4560 4173 }.
4561 4174  
... ... @@ -4578,17 +4191,18 @@ define Printable_tree
4578 4191 *** [5.10] Formating meta-tags.
4579 4192  
4580 4193 define Printable_tree
4581   - format_keywords
4582   - (
4583   - List(String) l
4584   - ) =
4585   - if l is
4586   - {
4587   - [] then [ ],
4588   - [h . t] then if t is []
4589   - then [h]
4590   - else [h , ", " . format_keywords(t)]
4591   - }.
  4194 + format_keywords
  4195 + (
  4196 + List(String) l
  4197 + ) =
  4198 + if l is
  4199 + {
  4200 + [] then [ ],
  4201 + [h . t] then if t is []
  4202 + then [h]
  4203 + else [h , ", " . format_keywords(t)]
  4204 + }
  4205 +.
4592 4206  
4593 4207  
4594 4208 define Printable_tree
... ... @@ -4852,7 +4466,7 @@ public define AWP_Handler_Answer //Printable_tree
4852 4466 with
4853 4467 answer_body_body = (Printable_tree)
4854 4468 [ "<body ", format_attrs(options), ">", // format body options
4855   - format(cinfo,ic_v,element,is_https, var(0), p_content_partial_content),
  4469 + format(cinfo, ic_v, element, is_https, var(0), p_content_partial_content),
4856 4470 "</body>\n",
4857 4471  
4858 4472 "</html>"],
... ...
web/types/making_a_web_site.anubis
  Show/Hide comments   View file @2437881
... ... @@ -518,35 +518,7 @@ public type Link_attr:
518 518 event(HtmlEvents, String)
519 519 .
520 520  
521   -public define String
522   - to_String
523   - (
524   - Link_attr attr
525   - )=
526   - if attr is
527   - {
528   - crossorigin(c_origin) then "crossorigin=\""+to_String(c_origin)+"\"",
529   - href(url) then "href=\""+url+"\"",
530   - media(media) then "media=\""+media+"\"",
531   - referrerpolicy(r_policy) then "referrerpolicy=\""+to_String(r_policy)+"\"",
532   - rel(rel_attr) then "rel=\""+to_String(rel_attr)+"\"",
533   - sizes(_sizes) then "sizes=\""+_sizes+"\"",
534   - type(_type) then "type=\""+_type+"\"",
535   - as(_as) then "as=\""+_as+"\"",
536   - integrity(_integrity) then "integrity=\""+_integrity+"\"",
537   - event(_event, code) then to_String(_event)+"=\""+code+"\"",
538   - }
539   -.
540 521  
541   -public define String
542   - to_String
543   - (
544   - List(Link_attr) attrs
545   - )=
546   - join(" ", map((Link_attr attr) |->
547   - to_String(attr),
548   - attrs))
549   -.
550 522  
551 523  
552 524  
... ...
web/web_action.anubis
  Show/Hide comments   View file @2437881
... ... @@ -10,6 +10,7 @@ read system/string.anubis
10 10  
11 11 transmit xlib/web/types/web_action_name.anubis
12 12 transmit xlib/web/urllib.anubis
  13 +read xlib/web/js_tools.anubis
13 14  
14 15 public define String
15 16 format_extra_operands
... ... @@ -79,7 +80,7 @@ public define String
79 80 WEB_Action_Name action,
80 81 List((String,String)) extra_ops,
81 82 )=
82   - "'"+format_web_action_name(action, extra_ops)+"'"
  83 + to_JS_String(format_web_action_name(action, extra_ops))
83 84 .
84 85  
85 86 public define String
... ... @@ -88,7 +89,7 @@ public define String
88 89 WEB_Action_Name action,
89 90 (String,String) extra_ops,
90 91 )=
91   - "'"+format_web_action_name(action, extra_ops)+"'"
  92 + to_JS_String(format_web_action_name(action, extra_ops))
92 93 .
93 94  
94 95 public define String
... ...