diff options
| author | Micael Karlberg <[email protected]> | 2011-11-01 18:14:58 +0100 |
|---|---|---|
| committer | Micael Karlberg <[email protected]> | 2011-11-01 18:14:58 +0100 |
| commit | 2da7b99f186e7a8f9a74b1c7aa60b1354cbc31ea (patch) | |
| tree | e47f27ddf5c4a2846bbe578e18d9f41b9de10c15 /lib/inets/src/http_lib/http_uri.erl | |
| parent | f8b20b4a995727f0339074d23a0fae50712683d2 (diff) | |
| parent | b6719f7943cbaeb10d5121f360f9540db494b639 (diff) | |
| download | otp-2da7b99f186e7a8f9a74b1c7aa60b1354cbc31ea.tar.gz otp-2da7b99f186e7a8f9a74b1c7aa60b1354cbc31ea.tar.bz2 otp-2da7b99f186e7a8f9a74b1c7aa60b1354cbc31ea.zip | |
[httpd] XSS prevention did not work for hex-encoded URL's.
OTP-9655
Merge branch 'bmk/inets/httpd/xss_when_erl_encoded/r13/OTP-9655' into bmk/inets/inets536_integration
Diffstat (limited to 'lib/inets/src/http_lib/http_uri.erl')
| -rw-r--r-- | lib/inets/src/http_lib/http_uri.erl | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/lib/inets/src/http_lib/http_uri.erl b/lib/inets/src/http_lib/http_uri.erl index 3804af60f4..d03acff3a9 100644 --- a/lib/inets/src/http_lib/http_uri.erl +++ b/lib/inets/src/http_lib/http_uri.erl @@ -21,7 +21,8 @@ -module(http_uri). -export([parse/1]). --export([parse/1, encode/1, decode/1]). +-export([encode/1, decode/1]). + %%%========================================================================= %%% API @@ -45,16 +46,21 @@ encode(URI) -> $\\, $', $^, $%, $ ]), lists:append(lists:map(fun(Char) -> uri_encode(Char, Reserved) end, URI)). -decode([$%,Hex1,Hex2|Rest]) -> - [hex2dec(Hex1)*16+hex2dec(Hex2)|decode(Rest)]; -decode([First|Rest]) -> - [First|decode(Rest)]; -decode([]) -> +decode(String) -> + do_decode(String). + +do_decode([$%,Hex1,Hex2|Rest]) -> + [hex2dec(Hex1)*16+hex2dec(Hex2)|do_decode(Rest)]; +do_decode([First|Rest]) -> + [First|do_decode(Rest)]; +do_decode([]) -> []. + %%%======================================================================== %%% Internal functions %%%======================================================================== + parse_scheme(AbsURI) -> case split_uri(AbsURI, ":", {error, no_scheme}, 1, 1) of {error, no_scheme} -> |