mike/biboumi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Properly sanitize everything in the XML we send to the XMPP server

Browse Source 
in this order:
- Make sure it is utf-8 encoded
- Remove all chars that are invalid in XML
- Escape all XML special chars (&'"<>)
This commit is contained in:
Florent Le Coz
2015-02-26 04:58:07 +01:00
parent 53e6b1da69
commit 6a2240f593
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/xmpp/xmpp_stanza.cpp
+11 -4
View File
@@ -218,13 +218,12 @@ std::string XmlNode::to_string() const
std::string res("<");
res += this->name;
for (const auto& it: this->attributes)
res += " " + utils::remove_invalid_xml_chars(it.first) + "='" +
utils::remove_invalid_xml_chars(it.second) + "'";
res += " " + it.first + "='" + sanitize(it.second) + "'";
if (this->closed && !this->has_children() && this->inner.empty())
res += "/>";
else
{
res += ">" + utils::remove_invalid_xml_chars(this->inner);
res += ">" + sanitize(this->inner);
for (const auto& child: this->children)
res += child->to_string();
if (this->closed)
@@ -232,7 +231,7 @@ std::string XmlNode::to_string() const
res += "</" + this->get_name() + ">";
}
}
res += utils::remove_invalid_xml_chars(this->tail);
res += sanitize(this->tail);
return res;
}
@@ -265,3 +264,11 @@ std::string& XmlNode::operator[](const std::string& name)
{
return this->attributes[name];
}
std::string sanitize(const std::string& data)
{
if (utils::is_valid_utf8(data.data()))
return xml_escape(utils::remove_invalid_xml_chars(data));
else
return xml_escape(utils::remove_invalid_xml_chars(utils::convert_to_utf8(data, "ISO-8859-1")));
}