[asterisk-dev] [Code Review] Properly escape characters in URIs

[Matthew Nicholson]

> On 2011-01-19 15:51:58, Tilghman Lesher wrote:
> > /trunk/include/asterisk/utils.h, line 257
> > <https://reviewboard.asterisk.org/r/1081/diff/2/?file=14898#file14898line257>
> >
> >     This might be better specified as AST_URI_HTTP or another metatag that specifies which URI use, since the problem has been one of distinguishing reserved characters in multiple URI specifications.  This could additionally be broken out with AST_URI_HTTP_LEGACY, to add encoding/decoding of the space character as the '+' character (a legacy use not supported in the current RFCs).  See the implementation of the hash_compat option to CURLOPT() in func_curl.c.
> >     
> >     This specification may be additionally helpful in ast_uri_decode for that purpose.

I agree.


- Matthew


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviewboard.asterisk.org/r/1081/#review3110
-----------------------------------------------------------


On 2011-01-19 15:08:50, Matthew Nicholson wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviewboard.asterisk.org/r/1081/
> -----------------------------------------------------------
> 
> (Updated 2011-01-19 15:08:50)
> 
> 
> Review request for Asterisk Developers.
> 
> 
> Summary
> -------
> 
> According to section 19.1.2 of RFC 3261:
> 
>   For each component, the set of valid BNF expansions defines exactly
>   which characters may appear unescaped.  All other characters MUST be
>   escaped.
> 
> This patch modifies ast_uri_encode() to encode strings in line with this recommendation.  This patch also adds an ast_escape_quoted() function which escapes '"' and '\' characters in quoted strings in accordance with section 25.1 of RFC 3261.  The ast_uri_encode() function has also been modified to take an ast_flags struct describing the set of rules it should use when escaping characters to allow for it to escape SIP URIs in addition to HTTP URIs and other types of URIs or variations of those two URI types in the future.
> 
> 
> Diffs
> -----
> 
>   /trunk/channels/chan_sip.c 302507 
>   /trunk/funcs/func_uri.c 302507 
>   /trunk/include/asterisk/utils.h 302507 
>   /trunk/main/utils.c 302507 
>   /trunk/res/res_agi.c 302507 
>   /trunk/res/res_config_curl.c 302507 
>   /trunk/tests/test_utils.c 302507 
> 
> Diff: https://reviewboard.asterisk.org/r/1081/diff
> 
> 
> Testing
> -------
> 
> The existing unit test for ast_uri_encode() has been modified to test the new functionality in addition to testing for a buffer overflow.  The new ast_escape_quoted() function has a similar test.
> 
> 
> Thanks,
> 
> Matthew
> 
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20110120/f63766d7/attachment-0001.htm>