Re: url protection

[Per Bothner]

On 8/5/22 10:35, Gavin Smith wrote:
> Could we write or copy the code for escaping a URL as it should
> be very short and simple?  This would avoid an extra module dependency.

Here is C/C++ code written by me.
It works in two passes - the first counts the number of bytes
that need to be escaped.  For Perl a single pass may make more sense.
 
/* Returns either NULL or a freshly malloc'd urlencoding of 'in'. */
char *
url_encode(const char *in, int mode)
{
    static unsigned char b16[] = "0123456789ABCDEF";
    int bad_count = 0;
    char *out = NULL;
    for (int pass = 0; pass < 2; pass++) {
        const char *p = in;
        char *q = out;
        while (*p) {
            int ch = *p++;
            bool ok = (ch >= '0' && ch <= '9')
              || (ch >= 'a' && ch <= 'z')
              || (ch >= 'A' && ch <= 'Z')
              || (ch == '/') /* may depend on mode */
              || (ch == '.' || ch == '-' || ch == '_'  || ch == '*');
            if (pass == 0) {
                if (! ok)
                  bad_count++;
            } else {
                if (ok)
                  *q++ = ch;
                else {
                    *q++ = '%';
                    *q++ = b16[(ch>>4) & 0xF];
                    *q++ = b16[ch & 0xF];
                }
            }
        }
        if (pass == 0) {
            if (bad_count == 0)
                return NULL;
            size_t in_size = (char*) p - in;
            out = challoc(in_size + 2 * bad_count + 1);
        } else
            *q = 0;
    }
    return out;
}

--
        --Per Bothner
per@bothner.com   http://per.bothner.com/