Updated http-server to make sure URLs in error-messages

are URL-encoded. Added support in http-client to use
URL-encoding. Also added the missing include directory
for the inets application.

OTP-8940

[httpd] Prevent XSS in error pages.
Prevent user controlled input from being interpreted
as HTML in error pages by encoding the reserved HTML
characters.
Michael Santos

OTP-9124

1 files changed, 47 insertions, 35 deletions

diff --git a/lib/inets/src/http_server/httpd_util.erl b/lib/inets/src/http_server/httpd_util.erl
index cfad79638f..7fe5d6d152 100644
--- a/lib/inets/src/http_server/httpd_util.erl
+++ b/lib/inets/src/http_server/httpd_util.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 1997-2010. All Rights Reserved.
+%% Copyright Ericsson AB 1997-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -21,7 +21,7 @@
 -export([ip_address/2, lookup/2, lookup/3, multi_lookup/2,
 	 lookup_mime/2, lookup_mime/3, lookup_mime_default/2,
 	 lookup_mime_default/3, reason_phrase/1, message/3, rfc1123_date/0,
-	 rfc1123_date/1, day/1, month/1, decode_hex/1,
+	 rfc1123_date/1, day/1, month/1, 
 	 flatlength/1, split_path/1, split_script_path/1, 
 	 suffix/1, split/3, uniq/1,
 	 make_name/2,make_name/3,make_name/4,strip/1,
@@ -32,7 +32,8 @@
 	 dir_validate/2, file_validate/2, mime_type_validate/1, 
 	 mime_types_validate/1, custom_date/0]).
 
--export([encode_hex/1]).
+-export([encode_hex/1, decode_hex/1]).
+
 -include_lib("kernel/include/file.hrl").
 
 ip_address({_,_,_,_} = Address, _IpFamily) ->
@@ -175,14 +176,15 @@ reason_phrase(_) -> "Internal Server Error".
 %% message
 
 message(301,URL,_) ->
-    "The document has moved <A HREF=\""++URL++"\">here</A>.";
+    "The document has moved <A HREF=\"" ++ maybe_encode(URL) ++"\">here</A>.";
 message(304, _URL,_) ->
     "The document has not been changed.";
-message(400,none,_) ->
+message(400, none, _) ->
     "Your browser sent a query that this server could not understand.";
-message(400,Msg,_) ->
-    "Your browser sent a query that this server could not understand. "++Msg;
-message(401,none,_) ->
+message(400, Msg, _) ->
+    "Your browser sent a query that this server could not understand. " ++ 
+	http_util:html_encode(Msg);
+message(401, none, _) ->
     "This server could not verify that you
 are authorized to access the document you
 	requested.  Either you supplied the wrong
@@ -190,40 +192,57 @@ credentials (e.g., bad password), or your
 browser doesn't understand how to supply
 the credentials required.";
 message(403,RequestURI,_) ->
-    "You don't have permission to access "++RequestURI++" on this server.";
+    "You don't have permission to access " ++ 
+	http_util:html_encode(RequestURI) ++ 
+	" on this server.";
 message(404,RequestURI,_) ->
-    "The requested URL "++RequestURI++" was not found on this server.";
+    "The requested URL " ++ 
+	http_util:html_encode(RequestURI) ++ 
+	" was not found on this server.";
 message(408, Timeout, _) ->
     Timeout;
 message(412,none,_) ->
     "The requested preconditions where false";
 message(413, Reason,_) ->
-    "Entity: " ++ Reason;
+    "Entity: " ++ http_util:html_encode(Reason);
 message(414,ReasonPhrase,_) ->
-    "Message "++ReasonPhrase++".";
+    "Message " ++ http_util:html_encode(ReasonPhrase) ++ ".";
 message(416,ReasonPhrase,_) ->
-    ReasonPhrase;
+    http_util:html_encode(ReasonPhrase);
 
 message(500,_,ConfigDB) ->
-    ServerAdmin=lookup(ConfigDB,server_admin,"unknown@unknown"),
+    ServerAdmin = lookup(ConfigDB, server_admin, "unknown@unknown"),
     "The server encountered an internal error or "
 	"misconfiguration and was unable to complete "
 	"your request.<P>Please contact the server administrator "
-	++ ServerAdmin ++ ", and inform them of the time the error occurred "
+	++ http_util:html_encode(ServerAdmin) ++ 
+	", and inform them of the time the error occurred "
 	"and anything you might have done that may have caused the error.";
 
 message(501,{Method, RequestURI, HTTPVersion}, _ConfigDB) ->
     if
 	is_atom(Method) ->
 	    atom_to_list(Method)++
-		" to "++RequestURI++" ("++HTTPVersion++") not supported.";
+		" to " ++ 
+		http_util:html_encode(RequestURI) ++ 
+		" (" ++ HTTPVersion ++ ") not supported.";
 	is_list(Method) ->
 	    Method++
-		" to "++RequestURI++" ("++HTTPVersion++") not supported."
+		" to " ++ 
+		http_util:html_encode(RequestURI) ++ 
+		" (" ++ HTTPVersion ++ ") not supported."
     end;
 
 message(503, String, _ConfigDB) ->
-    "This service in unavailable due to: "++String.
+    "This service in unavailable due to: " ++ http_util:html_encode(String).
+
+maybe_encode(URI) ->
+    case lists:member($%, URI) of
+		      true ->
+			     URI;
+		      false ->
+			     http_uri:encode(URI)
+		     end.
 
 %%convert_rfc_date(Date)->{{YYYY,MM,DD},{HH,MIN,SEC}}
 
@@ -381,16 +400,11 @@ month(12) -> "Dec".
 
 %% decode_hex
 
-decode_hex([$%,Hex1,Hex2|Rest]) ->
-    [hex2dec(Hex1)*16+hex2dec(Hex2)|decode_hex(Rest)];
-decode_hex([First|Rest]) ->
-    [First|decode_hex(Rest)];
-decode_hex([]) ->
-    [].
+decode_hex(URI) ->
+    http_uri:decode(URI).
 
-hex2dec(X) when (X>=$0) andalso (X=<$9) -> X-$0;
-hex2dec(X) when (X>=$A) andalso (X=<$F) -> X-$A+10;
-hex2dec(X) when (X>=$a) andalso (X=<$f) -> X-$a+10.
+encode_hex(URI) ->
+    http_uri:encode(URI).
 
 %% flatlength
 flatlength(List) ->
@@ -411,7 +425,7 @@ split_path(Path) ->
     case inets_regexp:match(Path,"[\?].*\$") of
 	%% A QUERY_STRING exists!
 	{match,Start,Length} ->
-	    {httpd_util:decode_hex(string:substr(Path,1,Start-1)),
+	    {http_uri:decode(string:substr(Path,1,Start-1)),
 	     string:substr(Path,Start,Length)};
 	%% A possible PATH_INFO exists!
 	nomatch ->
@@ -419,9 +433,9 @@ split_path(Path) ->
     end.
 
 split_path([],SoFar) ->
-    {httpd_util:decode_hex(lists:reverse(SoFar)),[]};
+    {http_uri:decode(lists:reverse(SoFar)),[]};
 split_path([$/|Rest],SoFar) ->
-    Path=httpd_util:decode_hex(lists:reverse(SoFar)),
+    Path = http_uri:decode(lists:reverse(SoFar)),
     case file:read_file_info(Path) of
 	{ok,FileInfo} when FileInfo#file_info.type =:= regular ->
 	    {Path,[$/|Rest]};
@@ -454,7 +468,7 @@ pathinfo_querystring([C|Rest], SoFar) ->
     pathinfo_querystring(Rest, [C|SoFar]).
 
 split_script_path([$?|QueryString], SoFar) ->
-    Path = httpd_util:decode_hex(lists:reverse(SoFar)),
+    Path = http_uri:decode(lists:reverse(SoFar)),
     case file:read_file_info(Path) of
 	{ok,FileInfo} when FileInfo#file_info.type =:= regular ->
 	    {Path, [$?|QueryString]};
@@ -464,7 +478,7 @@ split_script_path([$?|QueryString], SoFar) ->
 	    not_a_script
     end;
 split_script_path([], SoFar) ->
-    Path = httpd_util:decode_hex(lists:reverse(SoFar)),
+    Path = http_uri:decode(lists:reverse(SoFar)),
     case file:read_file_info(Path) of
 	{ok,FileInfo} when FileInfo#file_info.type =:= regular ->
 	    {Path, []};
@@ -474,7 +488,7 @@ split_script_path([], SoFar) ->
 	    not_a_script
     end;
 split_script_path([$/|Rest], SoFar) ->
-    Path = httpd_util:decode_hex(lists:reverse(SoFar)),
+    Path = http_uri:decode(lists:reverse(SoFar)),
     case file:read_file_info(Path) of
 	{ok, FileInfo} when FileInfo#file_info.type =:= regular ->
 	    {Path, [$/|Rest]};
@@ -608,8 +622,6 @@ hexlist_to_integer(List)->
 %%----------------------------------------------------------------------
 %%Converts an integer to an hexlist
 %%----------------------------------------------------------------------
-encode_hex(Num)->
-    integer_to_hexlist(Num).
 
 integer_to_hexlist(Num) when is_integer(Num) ->
     http_util:integer_to_hexlist(Num).