apr_escape.h 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374
  1. /* Licensed to the Apache Software Foundation (ASF) under one or more
  2. * contributor license agreements. See the NOTICE file distributed with
  3. * this work for additional information regarding copyright ownership.
  4. * The ASF licenses this file to You under the Apache License, Version 2.0
  5. * (the "License"); you may not use this file except in compliance with
  6. * the License. You may obtain a copy of the License at
  7. *
  8. * http://www.apache.org/licenses/LICENSE-2.0
  9. *
  10. * Unless required by applicable law or agreed to in writing, software
  11. * distributed under the License is distributed on an "AS IS" BASIS,
  12. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13. * See the License for the specific language governing permissions and
  14. * limitations under the License.
  15. */
  16. /**
  17. * @file apr_escape.h
  18. * @brief APR-UTIL Escaping
  19. */
  20. #ifndef APR_ESCAPE_H
  21. #define APR_ESCAPE_H
  22. #include "apr.h"
  23. #include "apr_general.h"
  24. #ifdef __cplusplus
  25. extern "C" {
  26. #endif
  27. /**
  28. * @defgroup APR_Util_Escaping Escape functions
  29. * @ingroup APR
  30. * @{
  31. */
  32. /* Simple escape/unescape functions.
  33. *
  34. */
  35. /**
  36. * When passing a string to one of the escape functions, this value can be
  37. * passed to indicate a string-valued key, and have the length computed
  38. * automatically.
  39. */
  40. #define APR_ESCAPE_STRING (-1)
  41. /**
  42. * Perform shell escaping on the provided string.
  43. *
  44. * Shell escaping causes characters to be prefixed with a '\' character.
  45. * @param escaped Optional buffer to write the encoded string, can be
  46. * NULL
  47. * @param str The original string
  48. * @param slen The length of the original string, or APR_ESCAPE_STRING
  49. * @param len If present, returns the length of the string
  50. * @return APR_SUCCESS, or APR_NOTFOUND if no changes to the string were
  51. * detected or the string was NULL
  52. */
  53. APR_DECLARE(apr_status_t) apr_escape_shell(char *escaped, const char *str,
  54. apr_ssize_t slen, apr_size_t *len);
  55. /**
  56. * Perform shell escaping on the provided string, returning the result
  57. * from the pool.
  58. *
  59. * Shell escaping causes characters to be prefixed with a '\' character.
  60. *
  61. * If no characters were escaped, the original string is returned.
  62. * @param p Pool to allocate from
  63. * @param str The original string
  64. * @return the encoded string, allocated from the pool, or the original
  65. * string if no escaping took place or the string was NULL.
  66. */
  67. APR_DECLARE(const char *) apr_pescape_shell(apr_pool_t *p, const char *str)
  68. __attribute__((nonnull(1)));
  69. /**
  70. * Unescapes a URL, leaving reserved characters intact.
  71. * @param escaped Optional buffer to write the encoded string, can be
  72. * NULL
  73. * @param url String to be unescaped
  74. * @param slen The length of the original url, or APR_ESCAPE_STRING
  75. * @param forbid Optional list of forbidden characters, in addition to
  76. * 0x00
  77. * @param reserved Optional list of reserved characters that will be
  78. * left unescaped
  79. * @param plus If non zero, '+' is converted to ' ' as per
  80. * application/x-www-form-urlencoded encoding
  81. * @param len If set, the length of the escaped string will be returned
  82. * @return APR_SUCCESS on success, APR_NOTFOUND if no characters are
  83. * decoded or the string is NULL, APR_EINVAL if a bad escape sequence is
  84. * found, APR_BADCH if a character on the forbid list is found.
  85. */
  86. APR_DECLARE(apr_status_t) apr_unescape_url(char *escaped, const char *url,
  87. apr_ssize_t slen, const char *forbid, const char *reserved, int plus,
  88. apr_size_t *len);
  89. /**
  90. * Unescapes a URL, leaving reserved characters intact, returning the
  91. * result from a pool.
  92. * @param p Pool to allocate from
  93. * @param url String to be unescaped in place
  94. * @param forbid Optional list of forbidden characters, in addition to
  95. * 0x00
  96. * @param reserved Optional list of reserved characters that will be
  97. * left unescaped
  98. * @param plus If non zero, '+' is converted to ' ' as per
  99. * application/x-www-form-urlencoded encoding
  100. * @return A string allocated from the pool on success, the original string
  101. * if no characters are decoded, or NULL if a bad escape sequence is found
  102. * or if a character on the forbid list is found, or if the original string
  103. * was NULL.
  104. */
  105. APR_DECLARE(const char *) apr_punescape_url(apr_pool_t *p, const char *url,
  106. const char *forbid, const char *reserved, int plus)
  107. __attribute__((nonnull(1)));
  108. /**
  109. * Escape a path segment, as defined in RFC1808.
  110. * @param escaped Optional buffer to write the encoded string, can be
  111. * NULL
  112. * @param str The original string
  113. * @param slen The length of the original string, or APR_ESCAPE_STRING
  114. * @param len If present, returns the length of the string
  115. * @return APR_SUCCESS, or APR_NOTFOUND if no changes to the string were
  116. * detected or the string was NULL
  117. */
  118. APR_DECLARE(apr_status_t) apr_escape_path_segment(char *escaped,
  119. const char *str, apr_ssize_t slen, apr_size_t *len);
  120. /**
  121. * Escape a path segment, as defined in RFC1808, returning the result from a
  122. * pool.
  123. * @param p Pool to allocate from
  124. * @param str String to be escaped
  125. * @return A string allocated from the pool on success, the original string
  126. * if no characters are encoded or the string is NULL.
  127. */
  128. APR_DECLARE(const char *) apr_pescape_path_segment(apr_pool_t *p,
  129. const char *str) __attribute__((nonnull(1)));
  130. /**
  131. * Converts an OS path to a URL, in an OS dependent way, as defined in RFC1808.
  132. * In all cases if a ':' occurs before the first '/' in the URL, the URL should
  133. * be prefixed with "./" (or the ':' escaped). In the case of Unix, this means
  134. * leaving '/' alone, but otherwise doing what escape_path_segment() does. For
  135. * efficiency reasons, we don't use escape_path_segment(), which is provided for
  136. * reference. Again, RFC 1808 is where this stuff is defined.
  137. *
  138. * If partial is set, os_escape_path() assumes that the path will be appended to
  139. * something with a '/' in it (and thus does not prefix "./").
  140. * @param escaped Optional buffer to write the encoded string, can be
  141. * NULL
  142. * @param path The original string
  143. * @param slen The length of the original string, or APR_ESCAPE_STRING
  144. * @param partial If non zero, suppresses the prepending of "./"
  145. * @param len If present, returns the length of the string
  146. * @return APR_SUCCESS, or APR_NOTFOUND if no changes to the string were
  147. * detected or if the string was NULL
  148. */
  149. APR_DECLARE(apr_status_t) apr_escape_path(char *escaped, const char *path,
  150. apr_ssize_t slen, int partial, apr_size_t *len);
  151. /**
  152. * Converts an OS path to a URL, in an OS dependent way, as defined in RFC1808,
  153. * returning the result from a pool.
  154. *
  155. * In all cases if a ':' occurs before the first '/' in the URL, the URL should
  156. * be prefixed with "./" (or the ':' escaped). In the case of Unix, this means
  157. * leaving '/' alone, but otherwise doing what escape_path_segment() does. For
  158. * efficiency reasons, we don't use escape_path_segment(), which is provided for
  159. * reference. Again, RFC 1808 is where this stuff is defined.
  160. *
  161. * If partial is set, os_escape_path() assumes that the path will be appended to
  162. * something with a '/' in it (and thus does not prefix "./").
  163. * @param p Pool to allocate from
  164. * @param str The original string
  165. * @param partial If non zero, suppresses the prepending of "./"
  166. * @return A string allocated from the pool on success, the original string
  167. * if no characters are encoded or if the string was NULL.
  168. */
  169. APR_DECLARE(const char *) apr_pescape_path(apr_pool_t *p, const char *str,
  170. int partial) __attribute__((nonnull(1)));
  171. /**
  172. * Urlencode a string, as defined in
  173. * http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.1.
  174. * @param escaped Optional buffer to write the encoded string, can be
  175. * NULL
  176. * @param str The original string
  177. * @param slen The length of the original string, or APR_ESCAPE_STRING
  178. * @param len If present, returns the length of the string
  179. * @return APR_SUCCESS, or APR_NOTFOUND if no changes to the string were
  180. * detected or if the stirng was NULL
  181. */
  182. APR_DECLARE(apr_status_t) apr_escape_urlencoded(char *escaped, const char *str,
  183. apr_ssize_t slen, apr_size_t *len);
  184. /**
  185. * Urlencode a string, as defined in
  186. * http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.1, returning
  187. * the result from a pool.
  188. * @param p Pool to allocate from
  189. * @param str String to be escaped
  190. * @return A string allocated from the pool on success, the original string
  191. * if no characters are encoded or if the string was NULL.
  192. */
  193. APR_DECLARE(const char *) apr_pescape_urlencoded(apr_pool_t *p,
  194. const char *str) __attribute__((nonnull(1)));
  195. /**
  196. * Apply entity encoding to a string. Characters are replaced as follows:
  197. * '<' becomes '&lt;', '>' becomes '&gt;', '&' becomes '&amp;', the
  198. * double quote becomes '&quot;" and the single quote becomes '&apos;'.
  199. *
  200. * If toasc is not zero, any non ascii character will be encoded as
  201. * '%\#ddd;', where ddd is the decimal code of the character.
  202. * @param escaped Optional buffer to write the encoded string, can be
  203. * NULL
  204. * @param str The original string
  205. * @param slen The length of the original string, or APR_ESCAPE_STRING
  206. * @param toasc If non zero, encode non ascii characters
  207. * @param len If present, returns the length of the string
  208. * @return APR_SUCCESS, or APR_NOTFOUND if no changes to the string were
  209. * detected or the string was NULL
  210. */
  211. APR_DECLARE(apr_status_t) apr_escape_entity(char *escaped, const char *str,
  212. apr_ssize_t slen, int toasc, apr_size_t *len);
  213. /**
  214. * Apply entity encoding to a string, returning the result from a pool.
  215. * Characters are replaced as follows: '<' becomes '&lt;', '>' becomes
  216. * '&gt;', '&' becomes '&amp;', the double quote becomes '&quot;" and the
  217. * single quote becomes '&apos;'.
  218. * @param p Pool to allocate from
  219. * @param str The original string
  220. * @param toasc If non zero, encode non ascii characters
  221. * @return A string allocated from the pool on success, the original string
  222. * if no characters are encoded or the string is NULL.
  223. */
  224. APR_DECLARE(const char *) apr_pescape_entity(apr_pool_t *p, const char *str,
  225. int toasc) __attribute__((nonnull(1)));
  226. /**
  227. * Decodes html entities or numeric character references in a string. If
  228. * the string to be unescaped is syntactically incorrect, then the
  229. * following fixups will be made:
  230. * unknown entities will be left undecoded;
  231. * references to unused numeric characters will be deleted.
  232. * In particular, &#00; will not be decoded, but will be deleted.
  233. * @param unescaped Optional buffer to write the encoded string, can be
  234. * NULL
  235. * @param str The original string
  236. * @param slen The length of the original string, or APR_ESCAPE_STRING
  237. * @param len If present, returns the length of the string
  238. * @return APR_SUCCESS, or APR_NOTFOUND if no changes to the string were
  239. * detected or the string was NULL
  240. */
  241. APR_DECLARE(apr_status_t) apr_unescape_entity(char *unescaped, const char *str,
  242. apr_ssize_t slen, apr_size_t *len);
  243. /**
  244. * Decodes html entities or numeric character references in a string. If
  245. * the string to be unescaped is syntactically incorrect, then the
  246. * following fixups will be made:
  247. * unknown entities will be left undecoded;
  248. * references to unused numeric characters will be deleted.
  249. * In particular, &#00; will not be decoded, but will be deleted.
  250. * @param p Pool to allocate from
  251. * @param str The original string
  252. * @return A string allocated from the pool on success, the original string
  253. * if no characters are encoded or the string is NULL.
  254. */
  255. APR_DECLARE(const char *) apr_punescape_entity(apr_pool_t *p, const char *str)
  256. __attribute__((nonnull(1)));
  257. /**
  258. * Escape control characters in a string, as performed by the shell's
  259. * 'echo' command. Characters are replaced as follows:
  260. * \\a alert (bell), \\b backspace, \\f form feed, \\n new line, \\r carriage
  261. * return, \\t horizontal tab, \\v vertical tab, \\ backslash.
  262. *
  263. * Any non ascii character will be encoded as '\\xHH', where HH is the hex
  264. * code of the character.
  265. *
  266. * If quote is not zero, the double quote character will also be escaped.
  267. * @param escaped Optional buffer to write the encoded string, can be
  268. * NULL
  269. * @param str The original string
  270. * @param slen The length of the original string, or APR_ESCAPE_STRING
  271. * @param quote If non zero, encode double quotes
  272. * @param len If present, returns the length of the string
  273. * @return APR_SUCCESS, or APR_NOTFOUND if no changes to the string were
  274. * detected or the string was NULL
  275. */
  276. APR_DECLARE(apr_status_t) apr_escape_echo(char *escaped, const char *str,
  277. apr_ssize_t slen, int quote, apr_size_t *len);
  278. /**
  279. * Escape control characters in a string, as performed by the shell's
  280. * 'echo' command, and return the results from a pool. Characters are
  281. * replaced as follows: \\a alert (bell), \\b backspace, \\f form feed,
  282. * \\n new line, \\r carriage return, \\t horizontal tab, \\v vertical tab,
  283. * \\ backslash.
  284. *
  285. * Any non ascii character will be encoded as '\\xHH', where HH is the hex
  286. * code of the character.
  287. *
  288. * If quote is not zero, the double quote character will also be escaped.
  289. * @param p Pool to allocate from
  290. * @param str The original string
  291. * @param quote If non zero, encode double quotes
  292. * @return A string allocated from the pool on success, the original string
  293. * if no characters are encoded or the string is NULL.
  294. */
  295. APR_DECLARE(const char *) apr_pescape_echo(apr_pool_t *p, const char *str,
  296. int quote);
  297. /**
  298. * Convert binary data to a hex encoding.
  299. * @param dest The destination buffer, can be NULL
  300. * @param src The original buffer
  301. * @param srclen The length of the original buffer
  302. * @param colon If not zero, insert colon characters between hex digits.
  303. * @param len If present, returns the length of the string
  304. * @return APR_SUCCESS, or APR_NOTFOUND if the string was NULL
  305. */
  306. APR_DECLARE(apr_status_t) apr_escape_hex(char *dest, const void *src,
  307. apr_size_t srclen, int colon, apr_size_t *len);
  308. /**
  309. * Convert binary data to a hex encoding, and return the results from a
  310. * pool.
  311. * @param p Pool to allocate from
  312. * @param src The original buffer
  313. * @param slen The length of the original buffer
  314. * @param colon If not zero, insert colon characters between hex digits.
  315. * @return A zero padded buffer allocated from the pool on success, or
  316. * NULL if src was NULL.
  317. */
  318. APR_DECLARE(const char *) apr_pescape_hex(apr_pool_t *p, const void *src,
  319. apr_size_t slen, int colon) __attribute__((nonnull(1)));
  320. /**
  321. * Convert hex encoded string to binary data.
  322. * @param dest The destination buffer, can be NULL
  323. * @param str The original buffer
  324. * @param slen The length of the original buffer
  325. * @param colon If not zero, ignore colon characters between hex digits.
  326. * @param len If present, returns the length of the string
  327. * @return APR_SUCCESS, or APR_NOTFOUND if the string was NULL, or APR_BADCH
  328. * if a non hex character is present.
  329. */
  330. APR_DECLARE(apr_status_t) apr_unescape_hex(void *dest, const char *str,
  331. apr_ssize_t slen, int colon, apr_size_t *len);
  332. /**
  333. * Convert hex encoding to binary data, and return the results from a pool.
  334. * If the colon character appears between pairs of hex digits, it will be
  335. * ignored.
  336. * @param p Pool to allocate from
  337. * @param str The original string
  338. * @param colon If not zero, ignore colon characters between hex digits.
  339. * @param len If present, returns the length of the final buffer
  340. * @return A buffer allocated from the pool on success, or NULL if src was
  341. * NULL, or a bad character was present.
  342. */
  343. APR_DECLARE(const void *) apr_punescape_hex(apr_pool_t *p, const char *str,
  344. int colon, apr_size_t *len);
  345. /** @} */
  346. #ifdef __cplusplus
  347. }
  348. #endif
  349. #endif /* !APR_ESCAPE_H */