[httpd] XSS prevention did not work for hex-encoded URL's.

OTP-9655
Merge branch 'bmk/inets/httpd/xss_when_erl_encoded/r14/OTP-9655' into bmk/inets/inets572_integration

1 files changed, 17 insertions, 11 deletions

diff --git a/lib/inets/src/http_lib/http_uri.erl b/lib/inets/src/http_lib/http_uri.erl
index 44b9face0b..607475c359 100644
--- a/lib/inets/src/http_lib/http_uri.erl
+++ b/lib/inets/src/http_lib/http_uri.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2006-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2006-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -20,7 +20,9 @@
 
 -module(http_uri).
 
--export([parse/1, encode/1, decode/1]).
+-export([parse/1]).
+-export([encode/1, decode/1]).
+
 
 %%%=========================================================================
 %%%  API
@@ -42,20 +44,24 @@ encode(URI) ->
     Reserved = sets:from_list([$;, $:, $@, $&, $=, $+, $,, $/, $?,
 			       $#, $[, $], $<, $>, $\", ${, $}, $|,
 			       $\\, $', $^, $%, $ ]),
-    lists:append(lists:map(fun(Char) ->
-				   uri_encode(Char, Reserved)
-			   end, URI)).
-
-decode([$%,Hex1,Hex2|Rest]) ->
-    [hex2dec(Hex1)*16+hex2dec(Hex2)|decode(Rest)];
-decode([First|Rest]) ->
-    [First|decode(Rest)];
-decode([]) ->
+    %% lists:append(lists:map(fun(Char) -> uri_encode(Char, Reserved) end, URI)).
+    lists:append([uri_encode(Char, Reserved) || Char <- URI]).
+
+decode(String) ->
+    do_decode(String).
+
+do_decode([$%,Hex1,Hex2|Rest]) ->
+    [hex2dec(Hex1)*16+hex2dec(Hex2)|do_decode(Rest)];
+do_decode([First|Rest]) ->
+    [First|do_decode(Rest)];
+do_decode([]) ->
     [].
 
+
 %%%========================================================================
 %%% Internal functions
 %%%========================================================================
+
 parse_scheme(AbsURI) ->
     case split_uri(AbsURI, ":", {error, no_scheme}, 1, 1) of
 	{error, no_scheme} ->