clean up the dead code

Security review of the html content. Now add encode_HTML_entities and to_JS_String protect it against the malicious string from user

clean up the dead code
Security review of the html content. Now add encode_HTML_entities and to_JS_String protect it against the malicious string from user
David RENÉ
1 parent fa3d214c
Showing 7 changed files with 105 additions and 517 deletions Show diff stats
web/jQuery/jq_dialog.anubis
web/jQuery/jq_form.anubis
web/jquery.anubis
web/load_content.anubis
web/making_a_web_site.anubis
web/types/making_a_web_site.anubis
web/web_action.anubis
@@ -154,7 +154,7 @@ public define String
     WEB_Action_Name       action,
     List((String,String)) extra_ops
   )=
-  "Xlib.jq_dialog_load('"+id(dialog_id)+"',"+format_web_action_name_to_js(action, extra_ops)+");"
+  "Xlib.jq_dialog_load("+to_JS_String(id(dialog_id))+", "+format_web_action_name_to_js(action, extra_ops)+");"
 .
@@ -33,6 +33,6 @@ public define String
   )=
   with dialog_id_str = if length(dialog_id) > 0 then ", '" + dialog_id + "'" else "",
   with call_back_str = if length(call_back) > 0 then ", "+call_back else "",
-  with url = format_web_action_name(action, extra_ops),
-  "Xlib.jq_form_submit_and_close('" + form_id + "', '" + url + "'"+dialog_id_str+call_back_str+");"
+  with url = format_web_action_name_to_js(action, extra_ops),
+  "Xlib.jq_form_submit_and_close(" + to_JS_String(form_id) + ", " + url + dialog_id_str+call_back_str+");"
 .
@@ -10,6 +10,7 @@ transmit xlib/web/making_a_web_site.anubis
 read xlib/web/load_content.anubis
 read tools/printable_tree.anubis
 read tools/basis.anubis
+read xlib/web/js_tools.anubis
 /* jQuery Actioner type */
 public type JQuery_Actioner_type:
@@ -92,7 +93,7 @@ public define String
                 }+
                 "$('#"+form+"').submit();\n",
               jqformload(form_id, target_id, web_action, extra_args)       then 
-                "Xlib.jq_form_submit_and_load('"+form_id+"', '"+format_web_action_name(web_action, extra_args)+"', '"+target_id+"');\n"
+                "Xlib.jq_form_submit_and_load("+to_JS_String(form_id)+", "+format_web_action_name_to_js(web_action, extra_args)+", "+to_JS_String(target_id)+");\n"
               jqlink(control_action, extra_ops)  then 
                 if control_action is
                 {
@@ -121,7 +122,7 @@ public define String
                 }+
                 "$('#"+form+"').submit();\n",       
               jqformload(form_id, target_id, web_action, extra_args)       then 
-                "Xlib.jq_form_submit_and_load('"+form_id+"', '"+format_web_action_name(web_action, extra_args)+"', '"+target_id+"');\n"
+                "Xlib.jq_form_submit_and_load("+to_JS_String(form_id)+", "+format_web_action_name_to_js(web_action, extra_args)+", "+to_JS_String(target_id)+");\n"
               jqlink(control_action, extra_ops)  then 
                 if control_action is
                 {
@@ -150,7 +151,7 @@ public define String
                 }+
                 "$('#"+form+"').submit();\n",
               jqformload(form_id, target_id, web_action, extra_args)       then 
-                "Xlib.jq_form_submit_and_load('"+form_id+"', '"+format_web_action_name(web_action, extra_args)+"', '"+target_id+"');\n"
+                "Xlib.jq_form_submit_and_load("+to_JS_String(form_id)+", "+format_web_action_name_to_js(web_action, extra_args)+", "+to_JS_String(target_id)+");\n"
               jqlink(control_action, extra_ops)  then 
                 if control_action is
                 {
@@ -18,7 +18,7 @@ public define String
     WEB_Action_Name       web_action,
     List((String,String)) extra_args
   )=
-  "window.open('"+format_web_action_name(web_action, extra_args)+"', '_blank', 'location=0');"
+  "window.open("+format_web_action_name_to_js(web_action, extra_args)+", '_blank', 'location=0');"
 .
 public define String
@@ -27,7 +27,7 @@ public define String
     WEB_Action_Name       web_action,
     List((String,String)) extra_args
   )=
-  "window.open('"+format_web_action_name(web_action, extra_args)+"', '_blank');"
+  "window.open("+format_web_action_name_to_js(web_action, extra_args)+", '_blank');"
 .
 public define String
@@ -36,7 +36,7 @@ public define String
     WEB_Action_Name       web_action,
     List((String,String)) extra_args
   )=
-  "location.href='"+format_web_action_name(web_action, extra_args)+"'"
+  "location.href="+format_web_action_name_to_js(web_action, extra_args)
 .
 public define String
@@ -67,7 +67,7 @@ public define String
     Bool                  overlay
   )=
-  "Xlib.load_content('"+target+"', '"+format_web_action_name(web_action, extra_args)+"', "+to_String(replace)+", "+to_String(replace)+");"
+  "Xlib.load_content('"+target+"', "+format_web_action_name_to_js(web_action, extra_args)+", "+to_String(replace)+", "+to_String(overlay)+");"
 .
 public define String
@@ -79,7 +79,7 @@ public define String
     Bool                  replace,
     Bool                  overlay
   )=
-  to_JS_String("Xlib.load_content('"+target+"', "+format_web_action_name_to_js(web_action, extra_args)+", "+to_String(replace)+", "+to_String(replace)+")")
+  to_JS_String("Xlib.load_content("+to_JS_String(target)+", "+format_web_action_name_to_js(web_action, extra_args)+", "+to_String(replace)+", "+to_String(overlay)+")")
 .
 public define String
@@ -184,5 +184,5 @@ public define String
     List((String,String)) extra_args
   )=
-  "Xlib.load_to_clipboard('"+format_web_action_name(web_action, extra_args)+"');"
+  "Xlib.load_to_clipboard("+format_web_action_name_to_js(web_action, extra_args)+");"
 .
@@ -62,6 +62,7 @@ read web/mime.anubis
 read xlib/web/cookies.anubis
 read xlib/web/json.anubis
+transmit xlib/web/js_tools.anubis
 transmit xlib/web/web_dump.anubis
 transmit xlib/web/web_arg_utils.anubis
 transmit xlib/web/web_session.anubis
@@ -771,6 +772,35 @@ public define String
 //public define Table_Option nude = border(0,0,0,rgb(0,0,0)).
+public define String 
+  to_String
+  (
+    Link_attr attr
+  )=
+  if attr is
+  {
+    crossorigin(c_origin) then  "crossorigin=\""+to_String(c_origin)+"\"",
+    href(url)             then  "href=\""+encode_HTML_entities(url)+"\"",
+    media(media)          then  "media=\""+encode_HTML_entities(media)+"\"",
+    referrerpolicy(r_policy)  then  "referrerpolicy=\""+to_String(r_policy)+"\"",
+    rel(rel_attr)         then  "rel=\""+to_String(rel_attr)+"\"",
+    sizes(_sizes)         then  "sizes=\""+encode_HTML_entities(_sizes)+"\"",
+    type(_type)           then  "type=\""+encode_HTML_entities(_type)+"\"",
+    as(_as)               then  "as=\""+encode_HTML_entities(_as)+"\"",
+    integrity(_integrity) then  "integrity=\""+encode_HTML_entities(_integrity)+"\"",
+    event(_event, code)   then  to_String(_event)+"=\""+encode_HTML_entities(code)+"\"",
+  }
+.
+
+public define String
+  to_String
+  (
+    List(Link_attr) attrs
+  )=
+  join(" ", map((Link_attr attr) |->
+    to_String(attr),
+    attrs))
+.
 public define Actioner_Aspect
@@ -2097,28 +2127,7 @@ public define HTML
    up to  the value of the  parameter $T), which correspond  to elements which  may be put
    anywhere in the page.
-//public define HTML
-//  partial_content
-//  (
-//    List(HTML_Head_Tag) tags,
-//    List(HTML) content
-//  )=
-//  partial_content(tags, sequence(content)).
-//  
-//public define HTML
-//  partial_content
-//  (
-//    HTML content
-//  )=
-//  partial_content([], content).
-//
-//public define HTML
-//  partial_content
-//  (
-//    List(HTML) content
-//  )=
-//  partial_content([], sequence(content)).
-//  
+
 public define HTML
   add_partial_content
   (
@@ -2128,7 +2137,7 @@ public define HTML
   if p_content is partial_content(_partial_content, html) then
     partial_content(tags + _partial_content, html)
   else
-    p_content
+    partial_content(tags, [p_content])
 .
 define HTML
@@ -2148,47 +2157,7 @@ define HTML
       else 
         list_to_pcontent(t, so_far_tags, [h . so_far_html])
   }.
-  
-//public define HTML
-//  partial_content
-//  (
-//    List(HTML) l_p_content
-//  )=
-//  list_to_pcontent(l_p_content, [], []).
-//  
-//public define HTML
-//  partial_empty
-//  =
-//  partial_content(empty)
-//.
-
- define String
-   format
-     (
-       List(Text_Option) l
-     ).    
-
- define Printable_tree
-   format_css_styles
-     (
-       List(CSS_Style)   l
-     ) =
-   if l is 
-     {
-       [ ] then [ ], 
-       [h . t] then 
-         [ if h is 
-             {
-               text_options(tos) then 
-                 ["   body, span, p { ", format(tos), " }\n" ]
-             }
-         . format_css_styles(t)]
-     }.
-   
-   
-   
-
-   
+    
    Meta tags are put in the 'head' of the HTML page. 
 public define HTML_Meta
@@ -2223,12 +2192,6 @@ public define HTTP_Answer
     [],                       // list of 'META' tags (empty for this site)
     body                      // body of page
     ( 
-      // list of body options
-      [
-        //background_color(rgb(255,200,200))
-        // add more body options here
-      ],
-      
       // content of page
       text(name+" Controller error")
     )
@@ -2238,9 +2201,6 @@ public define HTTP_Answer
    'HTTP_Answer' represents the final product of the construction of a web page. 
-   
-   
-   
       *** (3.2) ``in form'' versus ``off form''. 
    There is a variety of HTML  elements: texts, buttons, links, forms, inputs, etc... Some
@@ -3131,48 +3091,7 @@ define String
    }
   .
-// Compatibility function for older websites
- public define Web_Site
-  make_web_site_description
-  (
-       List(String)                common_names,   // for example: ["www.our-business.com"]
-       String                      site_directory,     
-       String                      state_directory,     
-       One -> One         init, 
-       (HTTP_Info, 
-        List(Web_arg),
-        Bool is_https) -> $State   initial_state,
-       ($State expired,
-        Maybe(String),
-        HTTP_Info,
-        List(Web_arg),
-        Bool is_https) -> $State    ticket_expired_state, 
-       (Maybe(String),
-        HTTP_Info,
-        List(Web_arg),
-        Bool is_https) -> $State   ticket_lost_state, 
-       List(Web_Action($State))    actions, 
-       $State -> HTTP_Answer         compute_page,
-       $State -> List(HTTP_header) additional_headers,
-       List(HTTP_header)            constant_additional_headers,
-       Int                         timeout,
-       Redirections                redirections, 
-       String                      charset, 
-       List(String)                journal_extensions,
-       List(String)                journal_headers,
-    (LogLevel, String) -> One                          logger,                 //logger
-       String                      secret, 
-       List(MIME)                  known_mime_types,
-       (String action_name,
-        List(Web_arg) args) -> One before_send_file
-       //Bool using_state_cookies
-  )
-  =
-    //generate an unique ID if doesn't exist in root of site_directory
-    with site_UID = get_site_uid(site_directory, logger),
-    make_web_site_description(site_UID, common_names, site_directory, state_directory, init, initial_state, ticket_expired_state, ticket_lost_state, actions, compute_page, additional_headers, constant_additional_headers, timeout, redirections, charset, journal_extensions, journal_headers, logger, secret, known_mime_types, before_send_file)
-.
-      
+     
       *** [4.3] Starting the servers. 
@@ -3274,48 +3193,6 @@ public define One
    implicitly to  the form containing  it.  The  name of that  form is transmitted  to the
    'format' functions called from within the formating of that form.
-   
-   
-   
-      *** [5.1] The type 'HTML_Any($T)'. 
-   
-   The type  'HTML_Any($T)' gathers elements  which may be  put anywhere in the  page. The
-   parameter $T becomes either 'HTML' or 'HTML_In_Form'.
-   
- type HTML_Any($T):
-   any_text               (List(CoreAttrs), String the_text), 
-   any_preformated        (List(CoreAttrs), String), 
-   any_paragraph          (List(CoreAttrs), List($T) content), 
-   //any_image              (List(CoreAttrs), String url, String alternate), 
-   //any_image              (List(CoreAttrs), String url, String alternate, Int width, Int height), 
-   //any_center             ($T), 
-   //any_mail_to            (String email, $T element), 
-   any_fixed_size         (HTML_Size width, HTML_Size height, $T content), 
-   any_fixed_size_2       (HTML_Size width, HTML_Size height, String name_of_HTML_file), 
-   any_actioner           (Actioner_Connection, 
-                           Actioner_Target, 
-                           Actioner_Aspect, 
-                           WEB_Action_Name action, 
-                           List((String,String)) extra_ops, 
-                           List(Actioner_Local_Action),
-                           Maybe(String) form_name),
-   any_foreign_link_new   (Actioner_Target, Actioner_Aspect, String url),                            
-   any_foreign_link       (List(CoreAttrs), String url), 
-   any_foreign_link       (List(CoreAttrs), String url, String name), 
-   any_private_download   (String abs_path, String name, String extra_ext,
-                             Maybe((String,List((String,String))))),
-   any_div                (List(CoreAttrs), List($T) element),
-   any_div_empty          (List(CoreAttrs)),
-   any_coreattrs          (List(CoreAttrs)),
-   any_ol                 (List(CoreAttrs), List($T) content), 
-   any_ul                 (List(CoreAttrs), List($T) content), 
-   any_li                 (List(CoreAttrs), List($T) content),
-   any_button             (List(CoreAttrs), List($T) element),
-   any_i                  (List(CoreAttrs), String text),
-   any_span               (List(CoreAttrs), String text),
-   any_hr                 (List(CoreAttrs))
-.
-   
       *** [5.2] Formating a color. 
@@ -3375,22 +3252,6 @@ define RGBA
    Each extra operand is a pair of strings: (name,value). It is formated as:
                  &oname=value
-
-
-   
-//public define String 
-//  format_extra_operands
-//  (
-//    List((String,String)) l
-//  ) =
-//  if l is 
-//  {
-//    [ ]     then "", 
-//    [h . t] then if h is (n,v) then  
-//    "&amp;"+n+"="+v+format_extra_operands(t)
-//  }
-//.
-
    It seams that the standard requires "&amp;" instead of "&" ! 
@@ -3434,30 +3295,6 @@ define Int
    The next function composes  the URL. It is a JavaScript URL  when the target is another
    window.
-//public define String
-//  format_web_action_name
-//  (
-//    WEB_Action_Name           action
-//  )=
-//  if action is
-//  {
-//    no_action                                   then "",  
-//    controller_action(controller, action_name)  then "?aws_controller="+controller+"&amp;aws_action="+action_name,
-//    action_name(action_name)                    then "?aws_action="+action_name,
-//    url(url)                                    then url
-//  }  
-//.
-//
-//public define String
-//  format_web_action_name
-//  (
-//    WEB_Action_Name           action,
-//    List((String,String))     extra_ops,        
-//  )=
-//  format_web_action_name(action)
-//  +
-//  format_extra_operands(extra_ops)
-//.
 define String 
   make_actioner_url
@@ -3490,7 +3327,7 @@ define String
    if target is 
      {
        same            then strict_url,
-       same(label)     then strict_url+"#"+label, 
+       same(label)     then strict_url+"#"+encode_HTML_entities(label), 
        other(wn,ops)   then 
          "javascript:void window.open('"+strict_url+"&amp;t="+wn+"','"+
@@ -3506,10 +3343,10 @@ define String
    if target is 
      {
        same            then "/",
-       same(label)     then "/#"+label, 
+       same(label)     then "/#"+encode_HTML_entities(label), 
        other(wn,ops)   then 
-         "javascript:void window.open('"+url+"','"+
+         "javascript:void window.open("+to_JS_String(url)+",'"+
                 "w"+to_ascii(sha1(wn))+"','"+format(ops)+"')"
      }. 
@@ -3566,76 +3403,6 @@ define URL_or_JavaScript
    Now, we format the actioner according to its aspect. 
-//define List(Text_Option)
-//  get_text_options
-//  (
-//     List(Text_Option) l
-//  )
-//  =
-//  if l is
-//  {
-//    []        then [],
-//    [h . t ]  then
-//      if h is class(_) then
-//        get_text_options(t)
-//      else if h is id(_) then
-//        get_text_options(t)
-//      else if h is style(_) then
-//        get_text_options(t)
-//      else if h is title(_) then
-//        get_text_options(t)
-//      else if h is core_attrs(_) then
-//        get_text_options(t)
-//      else
-//      [  h .  get_text_options(t) ]
-//   
-//  }.
-//  
-  /**
-   * Extract the CSS class list from the list of Text_Option
-   */
-//define List(CoreAttrs)
-//  get_css_class
-//  (
-//     List(Text_Option) l
-//  )
-//  =
-//  if l is
-//  {
-//    []        then [],
-//    [h . t ]  then
-//      if h is class(name) then
-//       [ class(name) .  get_css_class(t) ]
-//      else if h is id(name) then
-//       [ id(name) .  get_css_class(t) ]
-//      else if h is style(the_style) then
-//       [ style(the_style) .  get_css_class(t) ]
-//      else if h is title(name) then
-//       [ tooltip(name) .  get_css_class(t) ]
-//      else if h is attr(name, value) then
-//       [ attr(name, value) .  get_css_class(t) ]
-//      else
-//        get_css_class(t)
-//  }
-//.
-
-
-//define List(CoreAttrs)
-//  get_core_attrs
-//  (
-//     List(Text_Option) l
-//  )
-//  =
-//  if l is
-//  {
-//    []        then [],
-//    [h . t ]  then
-//      if h is core_attrs(attrs) then
-//       attrs + get_core_attrs(t)
-//      else
-//        get_core_attrs(t)
-//  }
-//  . 
 define Printable_tree
   format
@@ -3652,55 +3419,6 @@ define Printable_tree
          . format(t)]
      }. 
-    
-//define String
-//  format_attrs
-//  (
-//    List(InputAttrs)  attributs,
-//    List(String)      classes,
-//    List(String)      styles
-//  )=
-//  if attributs is
-//  {
-//    []      then 
-//      if length(classes) = 0 then "" else " class=\""+join(" ",classes)+"\""+
-//      if length(styles) = 0 then "" else " style=\""+join(";",styles)+"\"",
-//    [h . t] then 
-//      with new_classes = if h is class(class_name) then [class_name. classes] else classes,
-//           new_styles  = if h is style(style_string) then [style_string . styles] else styles,
-//           current = if h is
-//      {
-//        id(id_name)          then
-//           " id=\"" + id_name + "\"",
-//        class(class_name)    then "",
-//        style(style_string)  then "",     
-//        title(title_string)  then  
-//           " title=\"" + title_string + "\"",
-//        
-//        lang(lang) then  
-//           " xml:lang=" + lang,
-//        dir(reading_Way)  then
-//          if reading_Way is
-//          {
-//            ltr then  " dir=ltr",
-//            rtl then  " dir=rtl"
-//          },
-//        
-//        accesskey(key) then
-//          " accesskey=\"" + key + "\"",
-//        tabindex(index) then
-//          " tabindex=\"" + index + "\"",
-//      
-//        attr(name, value) then
-//           " " + name + "=\"" + value + "\"",
-//        
-//        event(e, value) then  
-//           " " + event_name(e) + "=\"" + value + "\"",
-//        data(name, value) then
-//          " data-" + to_lower(name) + "=\"" + value + "\"",
-//      },
-//      current + format_attrs(t, classes, styles)
-//  }.
 public define List(CoreAttrs) extract_attributes(HTML_tooltip htt).
@@ -3715,8 +3433,8 @@ define String
   {
     []      then 
       //concat all accumulated classes and styles 
-      (if length(classes) = 0 then "" else " class=\""+join(" ",classes)+"\"")+
-      if length(styles) = 0   then "" else " style=\""+join(";",styles)+"\"",
+      (if length(classes) = 0 then "" else " class=\""+encode_HTML_entities(join(" ",classes))+"\"")+
+      if length(styles) = 0   then "" else " style=\""+encode_HTML_entities(join(";",styles))+"\"",
     [h . t] then 
       with new_classes  = if h is class(class_name)   then [class_name. classes]    else classes,
            new_styles   = if h is style(style_string) then [style_string . styles]  else styles,
@@ -3726,14 +3444,14 @@ define String
                           {
                             empty_attr            then "",
                             id(id_name)           then
-                               " id=\"" + id_name + "\"",
+                               " id=\"" + encode_HTML_entities(id_name) + "\"",
                             class(class_name)     then "",   //do nothing here, because we accumulate the class until we have some other attributes
                             style(style_string)   then "",   //do nothing here, because we accumulate the style until we have some other attributes
                             title(title_string)   then  
-                               " title=\"" + title_string + "\"",
+                               " title=\"" + encode_HTML_entities(title_string) + "\"",
                             lang(lang)            then  
-                               " xml:lang=" + lang,
+                               " xml:lang=\"" + encode_HTML_entities(lang) + "\"",
                             dir(reading_Way)      then
                               if reading_Way is
                               {
@@ -3746,26 +3464,26 @@ define String
                             tabindex(index)       then
                               " tabindex=\"" + index + "\"",
                             attr(name, value)     then
-                               " " + name + "=\"" + value + "\"",
+                               " " + name + "=\"" + encode_HTML_entities(value) + "\"",
                             bool_attr(bool, value)then
                               if bool then " "+value+" " else "",
                             event(e, value)       then  
-                               " " + event_name(e) + "=\"" + value + "\"",
+                               " " + event_name(e) + "=\"" + encode_HTML_entities(value) + "\"",
                             tooltip(_)            then  "",   //do nothing here, because we extract attributes at first in new_attrs
                             data(name, value)     then
-                              " data-" + to_lower(name) + "=\"" + value + "\"",
+                              " data-" + to_lower(name) + "=\"" + encode_HTML_entities(value) + "\"",
                             contenteditable(value)then  //boolean value
                               " contenteditable=\""+ to_String(value)+ "\""
                             contextmenu(id_name)  then  //ID value
-                              " contextmenu=\"" + id_name + "\"",
+                              " contextmenu=\"" + encode_HTML_entities(id_name) + "\"",
                             draggable(value)      then  //boolean value
                               " draggable=\""+ to_String(value)+ "\"",
                             enterkeyhint(value)   then
-                              " enterkeyhint=\""+ value + "\"",
+                              " enterkeyhint=\""+ encode_HTML_entities(value) + "\"",
                             hidden(value)         then  //boolean value
                               " hidden=\""+ (if value then "hidden" else "") + "\"",
@@ -3774,7 +3492,7 @@ define String
                               " inert",
                             inputmode(value)      then
-                              " inputmode =\"" + value + "\"",
+                              " inputmode =\"" + encode_HTML_entities(value) + "\"",
                             popover               then
                               " popover",
@@ -3873,7 +3591,7 @@ define Printable_tree
        img_link(opt, img, alt_text)       then
                         [
                           "<a href=\"", full_url ,"\"", format_attrs(opt),"><img src=\"", img,
-                          "\" alt=\"" + alt_text + "\" border=\"0\"></a>"
+                          "\" alt=\"" + encode_HTML_entities(alt_text) + "\" border=\"0\"></a>"
                         ],
        push_button(options, text) then 
             ["<a href=\"",full_url,"\"", format_attrs(options), ">",
@@ -3952,12 +3670,12 @@ define Printable_tree
                         if action_name ="" then
                           [
                             "<img src=\"", img,"\"",
-                            format_attrs(options)," alt=\"" + alt_text + "\" border=\"0\">"
+                            format_attrs(options)," alt=\"" + encode_HTML_entities(alt_text) + "\" border=\"0\">"
                           ]                          
                         else
                           [
                             "<a href=\"", url,"\"", format_attrs(options),"><img src=\"", img,
-                            "\" alt=\"" + alt_text + "\" border=\"0\"></a>"
+                            "\" alt=\"" + encode_HTML_entities(alt_text) + "\" border=\"0\"></a>"
                           ],
        push_button(options, text) then 
          [
@@ -4092,13 +3810,6 @@ define Printable_tree
       *** [5.6] Formating rows and cells in a table. 
-//define Int
-//   percent
-//     (
-//       Int p
-//     ) =
-//   if p < 0 then 0 else if p > 100 then 100 else p. 
-   
 define Printable_tree
    format_scroller
@@ -4204,59 +3915,6 @@ define Printable_tree
   }.
-   // The function below formats a datum of type 'HTML_Any($T)'. 
-   
- define Printable_tree
-  format
-  ( 
-    CommonInfo                 cinfo, 
-    Var(Int)                   ic_v, 
-    HTML_Any($T)               element,
-    $T -> Printable_tree       format_element,  // able to format a datum of type $T
-    Bool                       is_https,
-    Var(Int)                   action_count,
-    Var(List(HTML_Head_Tag))   partial_content
-  ) =
-  if cinfo is info(common_name,http_port,https_port,site_directory,secret) then 
-  if element is 
-  {
-     
-    any_foreign_link_new(target, aspect, url)    then
-     format_foreign_link(target, aspect, url, is_https, cinfo, action_count, ic_v, partial_content),
-     
-    any_foreign_link(options,url)    then
-     ["<a href=\"",url,"\" ", format_attrs(options), "></a>"],  // IE7 doesn't support the form <a href="..." />
-    any_foreign_link(options,url,name)    then
-     ["<a href=\"",url,"\"><span ", format_attrs(options), ">",name,"</span></a>"], 
-    any_private_download(url,name,extra_ext,action)  then 
-     format_private_download(cinfo,url,name,extra_ext,action),
-    any_div(options, l)                   then
-     [format_div_option(options), flat(map(($T e) |-> format_element(e), l)),"</div>\n"],
-    any_div_empty(options)                then
-     [format_div_option(options), "</div>\n"],
-    any_coreattrs(attributs)              then
-     [format_attrs(attributs)],
-    any_ol(opts, l)         then 
-     ["<ol", format_attrs(opts), ">", flat(map(($T e) |-> format_element(e), l)),"</ol>\n"], 
-    any_ul(opts, l)         then 
-     ["<ul", format_attrs(opts), ">", flat(map(($T e) |-> format_element(e), l)),"</ul>\n"],
-    any_li(opts, l)         then 
-     ["<li", format_attrs(opts), ">", flat(map(($T e) |-> format_element(e), l)),"</li>\n"],
-    any_button(options, l)  then
-     [["<button" + format_attrs(options) + ">"], flat(map(($T e) |-> format_element(e), l)),"</button>\n"],
-    any_i(opts,t)           then
-      if t = "" then
-        ["<i", format_attrs(opts), "></i>\n"]
-      else
-        ["<i", format_attrs(opts), ">",t,"</i>\n"],
-    any_span(opts , t)            then 
-       ["<span", format_attrs(opts), ">",t,"</span>"]
-    any_hr(opts)            then
-      ["<hr", format_attrs(opts),">"]
-    }
-.
-
-
   //    *** [5.8] Formating 'in form' elements. 
@@ -4435,8 +4093,8 @@ define Printable_tree
   )=
   if _href is
   {
-    href(str)           then if str = "" then [] else [" href=\"", str, "\""],
-    href(action, extra) then [" href=\"",format_web_action_name(action, extra), "\""]
+    href(str)           then if str = "" then [] else [" href=\"", encode_HTML_entities(str), "\""],
+    href(action, extra) then [" href=\"",encode_HTML_entities(format_web_action_name(action, extra)), "\""]
   }
 .
@@ -4452,7 +4110,7 @@ define Printable_tree
       _self   then  "_self",
       _parent then  "_parent",
       _top    then  "_top",
-      framename(name) then  name
+      framename(name) then  encode_HTML_entities(name)
     },
   "\""]
 .
@@ -4471,91 +4129,46 @@ define Printable_tree
 define Printable_tree
   format
   (
-    CommonInfo               cinfo, 
-    Var(Int)                 ic_v,             // 'idnum' counter variable
-    HTML            element,
-    Bool                     is_https,
-    Var(Int)                 action_count,
-    Var(List(HTML_Head_Tag)) global_partial_content
+    CommonInfo                cinfo, 
+    Var(Int)                  ic_v,             // 'idnum' counter variable
+    HTML                      element,
+    Bool                      is_https,
+    Var(Int)                  action_count,
+    Var(List(HTML_Head_Tag))  global_partial_content
   ) =
-   if cinfo is info(common_name,http_port,https_port,site_directory,secret) then 
-   with format_element = (HTML e) |-> format(cinfo, ic_v, e, is_https, action_count, global_partial_content), 
+  if cinfo is info(common_name,http_port,https_port,site_directory,secret) then 
+    with format_element = (HTML e) |-> format(cinfo, ic_v, e, is_https, action_count, global_partial_content), 
   if element is 
   {
-    a(opts, _href, _target, l)      then ["<a ", format_attrs(opts), format_href(_href), format_target(_target), ">",flat(map(format_element,l)),"</a>\n"],
-    empty                           then [],
-       literal_pt(t)                then t, 
-       literal(t)                   then [t], 
-       sequence(l)                  then flat(map(format_element,l)),
-    text(opts,t)                 then 
-        if opts is
-        {
-          []      then [t],
-          [_ . _] then ["<span", format_attrs(opts), ">",t,"</span>"]
-        },
+    a(opts, _href, _target, l)  then ["<a ", format_attrs(opts), format_href(_href), format_target(_target), ">",flat(map(format_element,l)),"</a>\n"],
+    empty                       then [],
+    literal_pt(t)               then t, 
+    literal(t)                  then [t], 
+    sequence(l)                 then flat(map(format_element,l)),
+       
+    text(opts, t)                then 
+      if opts is
+      {
+        []      then [encode_HTML_entities(t)],
+        [_ . _] then ["<span", format_attrs(opts), ">",encode_HTML_entities(t),"</span>"]
+      },
        actioner(c,t,a,an,eo,ja)     then 
-         //format(cinfo,ic_v,
             format_actioner(cinfo,c,t,a,an,eo,ja,failure,is_https, action_count, ic_v, global_partial_content),
-         //   is_https, action_count, partial_content),
        actioner(c,t,a,an,eo,ja,fn)  then 
-         //format(cinfo,ic_v,
             format_actioner(cinfo,c,t,a,an,eo,ja,success(fn),is_https, action_count, ic_v, global_partial_content),
-         //   format_element,is_https, action_count, partial_content),
        foreign_link_new(target, aspect, url)  then
-         //format(cinfo,ic_v,
          format_foreign_link(target, aspect, url, is_https, cinfo, action_count, ic_v, global_partial_content),
-         //format_element,is_https, action_count, partial_content),
-         
-//       foreign_link(options,url,name)       then
-//         format(cinfo,ic_v,any_foreign_link(options,url,name),format_element,is_https, action_count, partial_content), 
        private_download(url, name, extra, action)     then 
-         //format(cinfo,ic_v,
-         format_private_download(cinfo, url, name, extra, action),
-         //format_element,is_https, action_count, partial_content),
-
-//       div(options, p_content)      then
-//        with html_elements = map((HTML pc) |-> 
-//                                 since pc is partial_content(tags, html_elem),
-//                                 partial_content <- *partial_content + tags; //accumulate the tags
-//                                 html_elem,                      //return the HTML element     
-//                                p_content),
-//            
-//          //format(cinfo, ic_v, 
-
-//          [format_div_option(options), flat(map((HTML e) |-> format_element(e), html_elements)),"</div>\n"], 
-          //format_element, is_https, action_count, partial_content),
-//       iframe(options, css_styles, css_files, js_files, body) then
-//          println("formating iframe");
-//          if body is body(body_options,elem) then
-//          [ "<iframe", format_attrs(options), " srcdoc=\"\n",
-//          
-//            encode_HTML_quote(to_String([
-//            "<html style=\"margin: 0pt; padding: 0pt;\">\n",
-//            "<head>\n",
-//            //add_css_styles(css_styles),
-//            add_css_files(css_files),
-//            add_js_files(js_files),
-//            "</head>\n",
-//            "<body ", format_attrs(body_options), ">\n",                       // format body options
-//            format(cinfo,ic_v, elem ,is_https, action_count, partial_content), 
-//            "</body>\n",
-//            "</html>\n",])),
-//            
-//            "\"></iframe>\n",
-//          ],
+         format_private_download(cinfo, url, name, extra, action),  
+
        partial_content(_partial_content, html_elements)    then
           global_partial_content <- *global_partial_content + _partial_content; //accumulate the tags
-//        if p_content is partial_content(tags, html_elements) then
-//          partial_content <- *partial_content + tags;          
-//          format(cinfo, ic_v, html_elements, is_https, action_count, partial_content),
           flat(map(format_element, html_elements))
-          
        html_tag(tag_name, opts, l)    then ["<",tag_name, format_attrs(opts), ">", flat(map(format_element,l)), "</",tag_name,">\n"],
-//       html_tag(tag_name, opts)       then ["<",tag_name, format_attrs(opts), "></",tag_name,">\n"],       
        html_void_tag(tag_name, opts)  then ["<",tag_name, format_attrs(opts), ">"],       
      }.
@@ -4578,17 +4191,18 @@ define Printable_tree
       *** [5.10] Formating meta-tags. 
 define Printable_tree
-   format_keywords
-     (
-       List(String) l
-     ) =
-   if l is 
-     {
-       []      then [ ], 
-       [h . t] then if t is []
-         then [h]
-         else [h , ", " . format_keywords(t)]
-     }. 
+  format_keywords
+  (
+    List(String) l
+  ) =
+  if l is 
+  {
+    []      then [ ], 
+    [h . t] then if t is []
+      then [h]
+      else [h , ", " . format_keywords(t)]
+  }
+.
 define Printable_tree
@@ -4852,7 +4466,7 @@ public define AWP_Handler_Answer //Printable_tree
           with
            answer_body_body = (Printable_tree)
            [  "<body ", format_attrs(options), ">",                       // format body options
-              format(cinfo,ic_v,element,is_https, var(0), p_content_partial_content), 
+              format(cinfo, ic_v, element, is_https, var(0), p_content_partial_content), 
               "</body>\n",
               "</html>"],
@@ -518,35 +518,7 @@ public type Link_attr:
   event(HtmlEvents, String)
 .
-public define String 
-  to_String
-  (
-    Link_attr attr
-  )=
-  if attr is
-  {
-    crossorigin(c_origin) then  "crossorigin=\""+to_String(c_origin)+"\"",
-    href(url)             then  "href=\""+url+"\"",
-    media(media)          then  "media=\""+media+"\"",
-    referrerpolicy(r_policy)  then  "referrerpolicy=\""+to_String(r_policy)+"\"",
-    rel(rel_attr)         then  "rel=\""+to_String(rel_attr)+"\"",
-    sizes(_sizes)         then  "sizes=\""+_sizes+"\"",
-    type(_type)           then  "type=\""+_type+"\"",
-    as(_as)               then  "as=\""+_as+"\"",
-    integrity(_integrity) then  "integrity=\""+_integrity+"\"",
-    event(_event, code)   then  to_String(_event)+"=\""+code+"\"",
-  }
-.
-public define String
-  to_String
-  (
-    List(Link_attr) attrs
-  )=
-  join(" ", map((Link_attr attr) |->
-    to_String(attr),
-    attrs))
-.
@@ -10,6 +10,7 @@ read system/string.anubis
 transmit xlib/web/types/web_action_name.anubis
 transmit xlib/web/urllib.anubis
+read xlib/web/js_tools.anubis
 public define String 
   format_extra_operands
@@ -79,7 +80,7 @@ public define String
     WEB_Action_Name           action,
     List((String,String))     extra_ops,
   )=
-  "'"+format_web_action_name(action, extra_ops)+"'"
+  to_JS_String(format_web_action_name(action, extra_ops))
 .
 public define String
@@ -88,7 +89,7 @@ public define String
     WEB_Action_Name   action,
     (String,String)   extra_ops,
   )=
-  "'"+format_web_action_name(action, extra_ops)+"'"
+  to_JS_String(format_web_action_name(action, extra_ops))
 .
 public define String