You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@santuario.apache.org by sc...@apache.org on 2011/06/25 03:39:12 UTC
svn commit: r1139478 - in /santuario/xml-security-cpp/trunk: ./
CHANGELOG.txt m4/ xsec/ xsec/framework/ xsec/utils/XSECDOMUtils.cpp
Author: scantor
Date: Sat Jun 25 01:39:11 2011
New Revision: 1139478
URL: http://svn.apache.org/viewvc?rev=1139478&view=rev
Log:
SANTUARIO-276 - multibyte sequences in cleanURIEscapes
Modified:
santuario/xml-security-cpp/trunk/ (props changed)
santuario/xml-security-cpp/trunk/CHANGELOG.txt
santuario/xml-security-cpp/trunk/m4/ (props changed)
santuario/xml-security-cpp/trunk/xsec/ (props changed)
santuario/xml-security-cpp/trunk/xsec/framework/ (props changed)
santuario/xml-security-cpp/trunk/xsec/utils/XSECDOMUtils.cpp
Propchange: santuario/xml-security-cpp/trunk/
------------------------------------------------------------------------------
--- svn:ignore (original)
+++ svn:ignore Sat Jun 25 01:39:11 2011
@@ -1 +1,16 @@
Build
+autom4te.cache
+build-aux
+aclocal.m4
+*.in
+configure
+libtool
+stamp-h1
+config.h
+config.status
+Makefile
+build
+.settings
+.project
+.autotools
+.cproject
Modified: santuario/xml-security-cpp/trunk/CHANGELOG.txt
URL: http://svn.apache.org/viewvc/santuario/xml-security-cpp/trunk/CHANGELOG.txt?rev=1139478&r1=1139477&r2=1139478&view=diff
==============================================================================
--- santuario/xml-security-cpp/trunk/CHANGELOG.txt (original)
+++ santuario/xml-security-cpp/trunk/CHANGELOG.txt Sat Jun 25 01:39:11 2011
@@ -5,6 +5,7 @@ Changes since 1.6.0
* [SANTUARIO-272] - Memory bug inside XENCCipherImpl::deSerialise
* [SANTUARIO-274] - Function cleanURIEscapes always throws XSECException, when any escape sequence occurs
* [SANTUARIO-275] - Function isHexDigit doesn't recognize invalid escape sequences.
+* [SANTUARIO-276] - Percent-encoded multibyte (UTF-8) sequences unrecognized
* [SANTUARIO-280] - RSA-OAEP handler only allows SHA-1 digests
Changes since 1.5.1
Propchange: santuario/xml-security-cpp/trunk/m4/
------------------------------------------------------------------------------
--- svn:ignore (added)
+++ svn:ignore Sat Jun 25 01:39:11 2011
@@ -0,0 +1,9 @@
+ltsugar.m4
+
+ltversion.m4
+
+lt~obsolete.m4
+
+libtool.m4
+
+ltoptions.m4
Propchange: santuario/xml-security-cpp/trunk/xsec/
------------------------------------------------------------------------------
--- svn:ignore (added)
+++ svn:ignore Sat Jun 25 01:39:11 2011
@@ -0,0 +1 @@
+*.in
Propchange: santuario/xml-security-cpp/trunk/xsec/framework/
------------------------------------------------------------------------------
--- svn:ignore (added)
+++ svn:ignore Sat Jun 25 01:39:11 2011
@@ -0,0 +1,3 @@
+stamp-h2
+
+XSECConfig.hpp
Modified: santuario/xml-security-cpp/trunk/xsec/utils/XSECDOMUtils.cpp
URL: http://svn.apache.org/viewvc/santuario/xml-security-cpp/trunk/xsec/utils/XSECDOMUtils.cpp?rev=1139478&r1=1139477&r2=1139478&view=diff
==============================================================================
--- santuario/xml-security-cpp/trunk/xsec/utils/XSECDOMUtils.cpp (original)
+++ santuario/xml-security-cpp/trunk/xsec/utils/XSECDOMUtils.cpp Sat Jun 25 01:39:11 2011
@@ -718,41 +718,45 @@ static unsigned int xlatHexDigit(const X
return (unsigned int)(toXlat - chLatin_a) + 10;
}
-XMLCh * cleanURIEscapes(const XMLCh * str) {
+XMLCh * cleanURIEscapes(const XMLCh * uriPath) {
- // Taken from Xerces XMLURI.cpp
+ XMLByte *ptr, *utf8Path;
+ xsecsize_t len = XMLString::stringLen(uriPath);
- XMLCh * retPath = XMLString::replicate(str);
+ ptr = utf8Path = new XMLByte[len + 1];
- xsecsize_t len = XMLString::stringLen(retPath);
- int percentIndex = XMLString::indexOf(retPath, chPercent, 0);
-
- while (percentIndex != -1) {
-
- if (percentIndex+2 >= len ||
- !isHexDigit(retPath[percentIndex+1]) ||
- !isHexDigit(retPath[percentIndex+2])) {
- XSEC_RELEASE_XMLCH(retPath);
- throw XSECException(XSECException::ErrorOpeningURI,
- "Bad escape sequence in URI");
- }
-
- unsigned int value = (xlatHexDigit(retPath[percentIndex+1]) * 16) +
- (xlatHexDigit(retPath[percentIndex+2]));
-
- retPath[percentIndex] = XMLCh(value);
- int i = 0;
- for (i = percentIndex+1 ; i < len - 2; ++i)
- retPath[i] = retPath[i+2];
- retPath[i] = chNull;
- len = i;
-
- percentIndex = XMLString::indexOf(retPath, chPercent, ++percentIndex);
-
- }
-
- return retPath;
+ for (xsecsize_t i = 0; i < len; i++) {
+ unsigned int value = uriPath[i];
+
+ if (value > 255) {
+ delete[] utf8Path;
+ throw XSECException(XSECException::ErrorOpeningURI, "Wide character in URI");
+ }
+
+ if (value == chPercent) {
+ if (!(i + 2 < len && isHexDigit(uriPath[i + 1]) && isHexDigit(uriPath[i + 2]))) {
+ delete[] utf8Path;
+ throw XSECException(XSECException::ErrorOpeningURI, "Bad escape sequence in URI");
+ }
+
+ value = (xlatHexDigit(uriPath[i + 1]) * 16) + (xlatHexDigit(uriPath[i + 2]));
+ i += 2;
+ }
+
+ *(ptr++) = (XMLByte) value;
+ }
+ *ptr = 0;
+
+ try {
+ XMLCh* unicodePath = transcodeFromUTF8(utf8Path);
+ delete[] utf8Path;
+ return unicodePath;
+ }
+ catch (XMLException&) {
+ }
+ delete[] utf8Path;
+ throw XSECException(XSECException::ErrorOpeningURI, "Failed to transcode URI from UTF-8");
}
// --------------------------------------------------------------------------------