Subject: http-gw: A new patch for JavaScript quoting

From: Marcin CIEŚLAK <[email-masked]>
Date: Mon, 24 Apr 2000 11:54:50 +0200 (MET DST)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I have developed a bit better solution for
JavaScript quoting in http-gw.
Apparently, the http-gw seemed to remove
the final quote in situations like:

<a href=Missing_first quote">
<a href=\"Some_guys__put_a_whole_code_in_js_variable\">

The patch enclosed postpones a write of the
final quote, _not_ removing the final quote from
the attribute's value.

The patch should be applied to the original source.

-- 
              << Marcin Cieślak // [email-masked] >>

--- http-gw.c_orig	Sun Apr 23 22:38:59 2000
+++ http-gw.c	Mon Apr 24 11:49:51 2000
@@ -1935,6 +1935,7 @@
 	static char value[1028];	/* attribute value */
 	char *p;			/* march thru above fields with this */
 	int quoted = 0;			/* current quote character or 0 */
+	int last_quoted = 0;	/* last character is final quote, skip */
 	int in_blocked = 0;		/* 1 if we are blocking part of HTML */
 	int got_close;			/* 1 if found a slash so match is close */
 	int check_now = 0;		/* 1 if done with field, time to check */
@@ -2237,6 +2238,7 @@
 				if ((p - value) > 1026) p--;
 				if (ch == quoted) {
 					quoted = 0;
+					last_quoted = 1; /* avoid double write */
 					state = IN_WS_1;
 					check_now = 1;
 				}
@@ -2284,10 +2286,6 @@
 			    (!strcasecmp(attribute,"content"))) 
 				    seek_and_destroy(value);
 
-			/* Quote at end removed to avoid double write*/
-			p = value + strlen(value) - 1;
-			if ((*p == '"') || (*p == '\'')) *p = 0;
-
 			/* write out the saved (or rewritten) field now */
 			if (!in_blocked)
 				net_write(sockfd,value,strlen(value));
@@ -2360,9 +2358,12 @@
 				&&
 			(state != IN_ATTRIBUTE)
 				&&
-			(state != IN_VALUE))) {
+			(state != IN_VALUE)
+				&&
+			(!last_quoted))) {
 			write(sockfd, buf, 1);
 		}
+		last_quoted = 0;
 		prev = ch;
 	}
 	/* if we ended due to EOF or content_length but were building up