diff options
| author | Micael Karlberg <[email protected]> | 2011-03-18 18:37:39 +0100 |
|---|---|---|
| committer | Micael Karlberg <[email protected]> | 2011-03-18 18:37:39 +0100 |
| commit | f39147b4c35dd06f48eba0a446dd6881aa46c917 (patch) | |
| tree | 62e15d94df972eb25b2603c97940a7f0cf3c5230 /lib/inets/src/http_lib/http_util.erl | |
| parent | f4b5ea566829cad609e14c2264158665b84800c1 (diff) | |
| parent | ffb2d69e00ef283eeb266f3082067429b6ce1127 (diff) | |
| download | otp-f39147b4c35dd06f48eba0a446dd6881aa46c917.tar.gz otp-f39147b4c35dd06f48eba0a446dd6881aa46c917.tar.bz2 otp-f39147b4c35dd06f48eba0a446dd6881aa46c917.zip | |
Merge branch 'bmk/inets/httpd/prevent_xss_in_error_pages/OTP-9124' into bmk/inets/inet56_integration
Conflicts:
lib/inets/doc/src/notes.xml
lib/inets/src/inets_app/inets.appup.src
Diffstat (limited to 'lib/inets/src/http_lib/http_util.erl')
| -rw-r--r-- | lib/inets/src/http_lib/http_util.erl | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/lib/inets/src/http_lib/http_util.erl b/lib/inets/src/http_lib/http_util.erl index 4f1147176c..5e6b69ac5e 100644 --- a/lib/inets/src/http_lib/http_util.erl +++ b/lib/inets/src/http_lib/http_util.erl @@ -25,7 +25,8 @@ hexlist_to_integer/1, integer_to_hexlist/1, convert_month/1, is_hostname/1, - timestamp/0, timeout/2 + timestamp/0, timeout/2, + html_encode/1 ]). @@ -187,6 +188,13 @@ timeout(Timeout, Started) -> end. +html_encode(Chars) -> + Reserved = sets:from_list([$&, $<, $>, $\", $', $/]), + lists:append(lists:map(fun(Char) -> + char_to_html_entity(Char, Reserved) + end, Chars)). + + %%%======================================================================== %%% Internal functions %%%======================================================================== @@ -235,3 +243,11 @@ convert_to_ascii([Num | Reversed], Number) convert_to_ascii([Num | Reversed], Number) when (Num > 9) andalso (Num < 16) -> convert_to_ascii(Reversed, [Num + 55 | Number]). + +char_to_html_entity(Char, Reserved) -> + case sets:is_element(Char, Reserved) of + true -> + "&#" ++ integer_to_list(Char) ++ ";"; + false -> + [Char] + end. |