From 595bd840f4ebd4ff849223a0f0865870da63d5cf Mon Sep 17 00:00:00 2001
From: totoro <david.rene@calexium.com>
Date: Tue, 20 Mar 2018 14:44:37 +0100
Subject: [PATCH] add encode_HTML_entities function which get an HTML text and encode it into escaped HTML. This allows to transmit HTML to HTML element i.e. input text area with text in HTML format must be encoded to avoid error.

---
 web/CXM_making_a_web_site.anubis | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--------------------
 1 file changed, 76 insertions(+), 20 deletions(-)

diff --git a/web/CXM_making_a_web_site.anubis b/web/CXM_making_a_web_site.anubis
index d4e7dcb..7bade8d 100644
--- a/web/CXM_making_a_web_site.anubis
+++ b/web/CXM_making_a_web_site.anubis
@@ -67,6 +67,63 @@ transmit CXM_web_action.anubis
 
 transmit calexium_lib/web/types/web_action_name.anubis
 
+//TODO move anywhere
+
+
+define List(Word8)
+/** Test for HTML entity which must be encoded
+ * and return the encoded entity if needed
+ */
+  get_entity
+  (
+    Word8       _char,
+    List(Word8) tail
+  )=
+  //test for the ampersand
+  if      _char = '&' then 
+    //test if it's already an encoded string like &amp; &lt; etc. In that case we do nothing
+    if      insensitive_equal(['&','a','m','p',';'],      tail, 0) then [_char]
+    else if insensitive_equal(['&','l','t',';'],          tail, 0) then [_char]
+    else if insensitive_equal(['&','g','t',';'],          tail, 0) then [_char]
+    else if insensitive_equal(['&','q','u','o','t',';'],  tail, 0) then [_char]
+    else
+      [';','p','m','a','&']
+  //test for '<' etc.
+  else if _char = '<'   then  [';','t','l','&']
+  else if _char = '>'   then  [';','t','g','&']
+  else if _char = '\"'  then  [';','t','o','u','q','&']
+  else                        [_char]
+.
+
+define String
+  _HTML_encode_entities
+  (
+    List(Word8) source,
+    List(Word8) current
+  )=
+  if source is
+  {
+    []      then implode(reverse(current)),
+    [c . t]  then
+      _HTML_encode_entities(t, get_entity(c, t) + current)
+  }
+.
+
+public define String
+  encode_HTML_entities
+  (
+    String source
+  )=
+  _HTML_encode_entities(explode(source), [])
+.
+
+//public define String
+//  encode_HTML_entities
+//  (
+//    String source
+//  )=
+//.
+
 //read CXM_html_tooltip.anubis
 
    * (1) Structure of a web site. 
@@ -4293,7 +4350,7 @@ public define Printable_tree
       [ ] then [ ], 
       [h . t] then
        if h is (attrs,val,item) 
-        then ["<option value=\""+val.value+"\" "+format_attrs(attrs)+">", item, "</option>\n" . format_choices(t)]
+        then ["<option value=\""+encode_HTML_entities(val.value)+"\" "+format_attrs(attrs)+">", item, "</option>\n" . format_choices(t)]
     }.
    
 public define Printable_tree
@@ -4308,8 +4365,8 @@ public define Printable_tree
       [h . t] then 
        if h is (attrs,val,item) then 
        if val.value = selected.value 
-         then ["<option value=\""+val.value+"\" "+format_attrs(attrs)+" selected=\"selected\">", item, "</option>\n" . format_choices(t)]
-         else ["<option value=\""+val.value+"\" "+format_attrs(attrs)+" >", item, "</option>\n" . format_choices(t,selected)]
+         then ["<option value=\""+encode_HTML_entities(val.value)+"\" "+format_attrs(attrs)+" selected=\"selected\">", item, "</option>\n" . format_choices(t)]
+         else ["<option value=\""+encode_HTML_entities(val.value)+"\" "+format_attrs(attrs)+" >", item, "</option>\n" . format_choices(t,selected)]
     }.
    
    
@@ -4938,9 +4995,9 @@ define Printable_tree
                               url(_)                    then ""
                             },
                             if action_name = "" then  
-                              ["<input type=\"button\" value=\"",text,"\"", format_attrs(options), " />"]
+                              ["<input type=\"button\" value=\"",encode_HTML_entities(text),"\"", format_attrs(options), " />"]
                             else
-                              [s,"<input type=\"button\" value=\"",text,"\"", format_attrs(options), " onclick=\"",h,"\" />"]
+                              [s,"<input type=\"button\" value=\"",encode_HTML_entities(text),"\"", format_attrs(options), " onclick=\"",h,"\" />"]
            }
          ], 
        button(url_off,url_on) then 
@@ -5779,18 +5836,17 @@ define Printable_tree
          format(cinfo,ic_v,any_foreign_link(options,url,name),format_element,is_https, action_count, head_tags), 
        private_download(url,name,extra,action)    then 
          format(cinfo,ic_v,any_private_download(url,name,extra,action),format_element,is_https, action_count, head_tags),    
-       text_input(options, label_text, id, name, i, w)           then 
-         
+       text_input(options, label_text, id, name, init, w)           then 
          [ format_label(label_text, id), 
-           "<input type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",i,"\"",format_attrs([class("in") . options])," />"],
-       text_input_ro(options, label_text, id, name,i,w)           then 
+           "<input type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",encode_HTML_entities(init.value),"\"",format_attrs([class("in") . options])," />"],
+       text_input_ro(options, label_text, id, name, init, w)           then 
          [ format_label(label_text, id), 
-           "<input readonly=\"readonly\" type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",i,"\"",format_attrs([class("in") . options])," />"],
-       password_input(options, label_text, id, name,i,w)         then 
+           "<input readonly=\"readonly\" type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",encode_HTML_entities(init.value),"\"",format_attrs([class("in") . options])," />"],
+       password_input(options, label_text, id, name, init, w)         then 
          [ format_label(label_text, id), 
-           "<input type=\"password\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",i,"\"",format_attrs([class("in") . options])," />"],
-       text_area(options,label_text, id, n,i,w,h)          then
-         [ format_label(label_text, id), "<textarea ",format(options)," id=\"",id,"\" name=\"",n,"\" cols=\"",w,"\" rows=\"",h,"\">",i,"</textarea>"],
+           "<input type=\"password\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",encode_HTML_entities(init.value),"\"",format_attrs([class("in") . options])," />"],
+       text_area(options,label_text, id, n, init, w, h)          then
+         [ format_label(label_text, id), "<textarea ",format(options)," id=\"",id,"\" name=\"",n,"\" cols=\"",w,"\" rows=\"",h,"\">",encode_HTML_entities(init.value),"</textarea>"],
        file_upload(options, label, id, n, w)            then 
          [ format_label(label, id), 
            "<input type=\"file\" id=\"",id,"\" size=\"",w,"\" name=\"",n,"\"",format_attrs([class("in") . options])," />"],
@@ -5807,11 +5863,11 @@ define Printable_tree
          [ format_label(label, id), 
           "<select id=\"",id,"\" name=\"",n,"\" size=\"",s,"\" ",format_attrs([class("in") . options]),">",format_choices(cs,sd),"</select>"],
    
-       radio_button(options, label, id, n, v, c)         then  
+       radio_button(options, label, id, n, value, c)         then  
          [ format_label(label, id), 
-           "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",v,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />"],
-       radio_button_r(options, label, id, n, v, c)         then  
-         [ "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",v,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />",
+           "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",value,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />"],
+       radio_button_r(options, label, id, n, value, c)         then  
+         [ "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",value,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />",
            format_label(label, id)],
        check_box(options, label, id, n, c)              then 
          [ format_label(label, id), 
@@ -5823,9 +5879,9 @@ define Printable_tree
         format(cinfo,ic_v,any_div(options, e),format_element,is_https, action_count, head_tags),    
        div_empty(options)               then
         format(cinfo,ic_v,any_div_empty(options),format_element,is_https, action_count, head_tags),
-      hidden(_id, name, value)          then
+      hidden(_id, name, init)          then
         since _id is html_Id(id),
-         ["<input type=\"hidden\"",(if id = "" then "" else " id=\""+id+"\"")," name=\"",name,"\" value=\"",value,"\" />"],
+         ["<input type=\"hidden\"",(if id = "" then "" else " id=\""+id+"\"")," name=\"",name,"\" value=\"",encode_HTML_entities(init.value),"\" />"],
        partial(p_content)               then
         if p_content is partial_content(tags, html_elements) then
           head_tags <- *head_tags + tags;
--
libgit2 0.21.4