add encode_HTML_entities function which get an HTML text and encode it into esca…

…ped HTML. This allows to transmit HTML to HTML element i.e. input text area with text in HTML format must be encoded to avoid error.

add encode_HTML_entities function which get an HTML text and encode it into esca…
…ped HTML. This allows to transmit HTML to HTML element i.e. input text area with text in HTML format must be encoded to avoid error.
totoro
1 parent 160d0690
Showing 1 changed file with 76 additions and 20 deletions Show diff stats
web/CXM_making_a_web_site.anubis
@@ -67,6 +67,63 @@ transmit CXM_web_action.anubis
 transmit calexium_lib/web/types/web_action_name.anubis
+//TODO move anywhere
+
+
+define List(Word8)
+/** Test for HTML entity which must be encoded
+ * and return the encoded entity if needed
+ */
+  get_entity
+  (
+    Word8       _char,
+    List(Word8) tail
+  )=
+  //test for the ampersand
+  if      _char = '&' then 
+    //test if it's already an encoded string like &amp; &lt; etc. In that case we do nothing
+    if      insensitive_equal(['&','a','m','p',';'],      tail, 0) then [_char]
+    else if insensitive_equal(['&','l','t',';'],          tail, 0) then [_char]
+    else if insensitive_equal(['&','g','t',';'],          tail, 0) then [_char]
+    else if insensitive_equal(['&','q','u','o','t',';'],  tail, 0) then [_char]
+    else
+      [';','p','m','a','&']
+  //test for '<' etc.
+  else if _char = '<'   then  [';','t','l','&']
+  else if _char = '>'   then  [';','t','g','&']
+  else if _char = '\"'  then  [';','t','o','u','q','&']
+  else                        [_char]
+.
+
+define String
+  _HTML_encode_entities
+  (
+    List(Word8) source,
+    List(Word8) current
+  )=
+  if source is
+  {
+    []      then implode(reverse(current)),
+    [c . t]  then
+      _HTML_encode_entities(t, get_entity(c, t) + current)
+  }
+.
+
+public define String
+  encode_HTML_entities
+  (
+    String source
+  )=
+  _HTML_encode_entities(explode(source), [])
+.
+
+//public define String
+//  encode_HTML_entities
+//  (
+//    String source
+//  )=
+//.
+
 //read CXM_html_tooltip.anubis
    * (1) Structure of a web site. 
@@ -4293,7 +4350,7 @@ public define Printable_tree
       [ ] then [ ], 
       [h . t] then
        if h is (attrs,val,item) 
-        then ["<option value=\""+val.value+"\" "+format_attrs(attrs)+">", item, "</option>\n" . format_choices(t)]
+        then ["<option value=\""+encode_HTML_entities(val.value)+"\" "+format_attrs(attrs)+">", item, "</option>\n" . format_choices(t)]
     }.
 public define Printable_tree
@@ -4308,8 +4365,8 @@ public define Printable_tree
       [h . t] then 
        if h is (attrs,val,item) then 
        if val.value = selected.value 
-         then ["<option value=\""+val.value+"\" "+format_attrs(attrs)+" selected=\"selected\">", item, "</option>\n" . format_choices(t)]
-         else ["<option value=\""+val.value+"\" "+format_attrs(attrs)+" >", item, "</option>\n" . format_choices(t,selected)]
+         then ["<option value=\""+encode_HTML_entities(val.value)+"\" "+format_attrs(attrs)+" selected=\"selected\">", item, "</option>\n" . format_choices(t)]
+         else ["<option value=\""+encode_HTML_entities(val.value)+"\" "+format_attrs(attrs)+" >", item, "</option>\n" . format_choices(t,selected)]
     }.
@@ -4938,9 +4995,9 @@ define Printable_tree
                               url(_)                    then ""
                             },
                             if action_name = "" then  
-                              ["<input type=\"button\" value=\"",text,"\"", format_attrs(options), " />"]
+                              ["<input type=\"button\" value=\"",encode_HTML_entities(text),"\"", format_attrs(options), " />"]
                             else
-                              [s,"<input type=\"button\" value=\"",text,"\"", format_attrs(options), " onclick=\"",h,"\" />"]
+                              [s,"<input type=\"button\" value=\"",encode_HTML_entities(text),"\"", format_attrs(options), " onclick=\"",h,"\" />"]
            }
          ], 
        button(url_off,url_on) then 
@@ -5779,18 +5836,17 @@ define Printable_tree
          format(cinfo,ic_v,any_foreign_link(options,url,name),format_element,is_https, action_count, head_tags), 
        private_download(url,name,extra,action)    then 
          format(cinfo,ic_v,any_private_download(url,name,extra,action),format_element,is_https, action_count, head_tags),    
-       text_input(options, label_text, id, name, i, w)           then 
-         
+       text_input(options, label_text, id, name, init, w)           then 
          [ format_label(label_text, id), 
-           "<input type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",i,"\"",format_attrs([class("in") . options])," />"],
-       text_input_ro(options, label_text, id, name,i,w)           then 
+           "<input type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",encode_HTML_entities(init.value),"\"",format_attrs([class("in") . options])," />"],
+       text_input_ro(options, label_text, id, name, init, w)           then 
          [ format_label(label_text, id), 
-           "<input readonly=\"readonly\" type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",i,"\"",format_attrs([class("in") . options])," />"],
-       password_input(options, label_text, id, name,i,w)         then 
+           "<input readonly=\"readonly\" type=\"text\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",encode_HTML_entities(init.value),"\"",format_attrs([class("in") . options])," />"],
+       password_input(options, label_text, id, name, init, w)         then 
          [ format_label(label_text, id), 
-           "<input type=\"password\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",i,"\"",format_attrs([class("in") . options])," />"],
-       text_area(options,label_text, id, n,i,w,h)          then
-         [ format_label(label_text, id), "<textarea ",format(options)," id=\"",id,"\" name=\"",n,"\" cols=\"",w,"\" rows=\"",h,"\">",i,"</textarea>"],
+           "<input type=\"password\" name=\"",name,"\" id=\"",id,"\" size=\"",w,"\" value=\"",encode_HTML_entities(init.value),"\"",format_attrs([class("in") . options])," />"],
+       text_area(options,label_text, id, n, init, w, h)          then
+         [ format_label(label_text, id), "<textarea ",format(options)," id=\"",id,"\" name=\"",n,"\" cols=\"",w,"\" rows=\"",h,"\">",encode_HTML_entities(init.value),"</textarea>"],
        file_upload(options, label, id, n, w)            then 
          [ format_label(label, id), 
            "<input type=\"file\" id=\"",id,"\" size=\"",w,"\" name=\"",n,"\"",format_attrs([class("in") . options])," />"],
@@ -5807,11 +5863,11 @@ define Printable_tree
          [ format_label(label, id), 
           "<select id=\"",id,"\" name=\"",n,"\" size=\"",s,"\" ",format_attrs([class("in") . options]),">",format_choices(cs,sd),"</select>"],
-       radio_button(options, label, id, n, v, c)         then  
+       radio_button(options, label, id, n, value, c)         then  
          [ format_label(label, id), 
-           "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",v,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />"],
-       radio_button_r(options, label, id, n, v, c)         then  
-         [ "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",v,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />",
+           "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",value,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />"],
+       radio_button_r(options, label, id, n, value, c)         then  
+         [ "<input type=\"radio\" name=\"",n,"\" id=\"",id,"\" value=\"",value,"\"",(if c then " checked=\"checked\"" else ""),format_attrs([class("in") . options])," />",
            format_label(label, id)],
        check_box(options, label, id, n, c)              then 
          [ format_label(label, id), 
@@ -5823,9 +5879,9 @@ define Printable_tree
         format(cinfo,ic_v,any_div(options, e),format_element,is_https, action_count, head_tags),    
        div_empty(options)               then
         format(cinfo,ic_v,any_div_empty(options),format_element,is_https, action_count, head_tags),
-      hidden(_id, name, value)          then
+      hidden(_id, name, init)          then
         since _id is html_Id(id),
-         ["<input type=\"hidden\"",(if id = "" then "" else " id=\""+id+"\"")," name=\"",name,"\" value=\"",value,"\" />"],
+         ["<input type=\"hidden\"",(if id = "" then "" else " id=\""+id+"\"")," name=\"",name,"\" value=\"",encode_HTML_entities(init.value),"\" />"],
        partial(p_content)               then
         if p_content is partial_content(tags, html_elements) then
           head_tags <- *head_tags + tags;