From 6eeefd208743b0b2edbd7330dea36eea5b1099b7 Mon Sep 17 00:00:00 2001
From: Hiltjo Posthuma <hiltjo@codemadness.org>
Date: Tue, 16 Nov 2021 14:16:46 +0100
Subject: percent encode characters in path names

Paths could contain characters like # (fragment), '?', control-characters, etc.
---
 stagit-index.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

(limited to 'stagit-index.c')

diff --git a/stagit-index.c b/stagit-index.c
index 84785a9..8a53463 100644
--- a/stagit-index.c
+++ b/stagit-index.c
@@ -28,6 +28,28 @@ joinpath(char *buf, size_t bufsiz, const char *path, const char *path2)
 			path, path[0] && path[strlen(path) - 1] != '/' ? "/" : "", path2);
 }
 
+/* Percent-encode, see RFC3986 section 2.1. */
+void
+percentencode(FILE *fp, const char *s, size_t len)
+{
+	static char tab[] = "0123456789ABCDEF";
+	unsigned char uc;
+	size_t i;
+
+	for (i = 0; *s && i < len; s++, i++) {
+		uc = *s;
+		/* NOTE: do not encode '/' for paths */
+		if (uc < '/' || uc >= 127 || (uc >= ':' && uc <= '@') ||
+		    uc == '[' || uc == ']') {
+			putc('%', fp);
+			putc(tab[(uc >> 4) & 0x0f], fp);
+			putc(tab[uc & 0x0f], fp);
+		} else {
+			putc(uc, fp);
+		}
+	}
+}
+
 /* Escape characters below as HTML 2.0 / XML 1.0. */
 void
 xmlencode(FILE *fp, const char *s, size_t len)
@@ -118,7 +140,7 @@ writelog(FILE *fp)
 			*p = '\0';
 
 	fputs("<tr><td><a href=\"", fp);
-	xmlencode(fp, stripped_name, strlen(stripped_name));
+	percentencode(fp, stripped_name, strlen(stripped_name));
 	fputs("/log.html\">", fp);
 	xmlencode(fp, stripped_name, strlen(stripped_name));
 	fputs("</a></td><td>", fp);
-- 
cgit v1.2.3