Fossil SCM
Integrate andygoth-quote-apostrophe. Needed because single quotes can be used in the tag filter entry, and these single quotes would otherwise be passed through unprotected to the output HTML.
Commit
68bd2e7bedb8d05a893978af8da12d61faaa18da
Parent
d4a6d3c1ec0ed83…
6 files changed
+13
-1
+13
-1
+13
-1
+2
+2
+2
+13
-1
| --- src/encode.c | ||
| +++ src/encode.c | ||
| @@ -23,11 +23,11 @@ | ||
| 23 | 23 | /* |
| 24 | 24 | ** Make the given string safe for HTML by converting every "<" into "<", |
| 25 | 25 | ** every ">" into ">" and every "&" into "&". Return a pointer |
| 26 | 26 | ** to a new string obtained from malloc(). |
| 27 | 27 | ** |
| 28 | -** We also encode " as " so that it can appear as an argument | |
| 28 | +** We also encode " as " and ' as ' so they can appear as an argument | |
| 29 | 29 | ** to markup. |
| 30 | 30 | */ |
| 31 | 31 | char *htmlize(const char *zIn, int n){ |
| 32 | 32 | int c; |
| 33 | 33 | int i = 0; |
| @@ -74,10 +74,17 @@ | ||
| 74 | 74 | zOut[i++] = 'u'; |
| 75 | 75 | zOut[i++] = 'o'; |
| 76 | 76 | zOut[i++] = 't'; |
| 77 | 77 | zOut[i++] = ';'; |
| 78 | 78 | break; |
| 79 | + case '\'': | |
| 80 | + zOut[i++] = '&'; | |
| 81 | + zOut[i++] = '#'; | |
| 82 | + zOut[i++] = '3'; | |
| 83 | + zOut[i++] = '9'; | |
| 84 | + zOut[i++] = ';'; | |
| 85 | + break; | |
| 79 | 86 | default: |
| 80 | 87 | zOut[i++] = c; |
| 81 | 88 | break; |
| 82 | 89 | } |
| 83 | 90 | zIn++; |
| @@ -112,10 +119,15 @@ | ||
| 112 | 119 | break; |
| 113 | 120 | case '"': |
| 114 | 121 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 115 | 122 | blob_append(p, """, 6); |
| 116 | 123 | j = i+1; |
| 124 | + break; | |
| 125 | + case '\'': | |
| 126 | + if( j<i ) blob_append(p, zIn+j, i-j); | |
| 127 | + blob_append(p, "'", 5); | |
| 128 | + j = i+1; | |
| 117 | 129 | break; |
| 118 | 130 | } |
| 119 | 131 | } |
| 120 | 132 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 121 | 133 | } |
| 122 | 134 |
| --- src/encode.c | |
| +++ src/encode.c | |
| @@ -23,11 +23,11 @@ | |
| 23 | /* |
| 24 | ** Make the given string safe for HTML by converting every "<" into "<", |
| 25 | ** every ">" into ">" and every "&" into "&". Return a pointer |
| 26 | ** to a new string obtained from malloc(). |
| 27 | ** |
| 28 | ** We also encode " as " so that it can appear as an argument |
| 29 | ** to markup. |
| 30 | */ |
| 31 | char *htmlize(const char *zIn, int n){ |
| 32 | int c; |
| 33 | int i = 0; |
| @@ -74,10 +74,17 @@ | |
| 74 | zOut[i++] = 'u'; |
| 75 | zOut[i++] = 'o'; |
| 76 | zOut[i++] = 't'; |
| 77 | zOut[i++] = ';'; |
| 78 | break; |
| 79 | default: |
| 80 | zOut[i++] = c; |
| 81 | break; |
| 82 | } |
| 83 | zIn++; |
| @@ -112,10 +119,15 @@ | |
| 112 | break; |
| 113 | case '"': |
| 114 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 115 | blob_append(p, """, 6); |
| 116 | j = i+1; |
| 117 | break; |
| 118 | } |
| 119 | } |
| 120 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 121 | } |
| 122 |
| --- src/encode.c | |
| +++ src/encode.c | |
| @@ -23,11 +23,11 @@ | |
| 23 | /* |
| 24 | ** Make the given string safe for HTML by converting every "<" into "<", |
| 25 | ** every ">" into ">" and every "&" into "&". Return a pointer |
| 26 | ** to a new string obtained from malloc(). |
| 27 | ** |
| 28 | ** We also encode " as " and ' as ' so they can appear as an argument |
| 29 | ** to markup. |
| 30 | */ |
| 31 | char *htmlize(const char *zIn, int n){ |
| 32 | int c; |
| 33 | int i = 0; |
| @@ -74,10 +74,17 @@ | |
| 74 | zOut[i++] = 'u'; |
| 75 | zOut[i++] = 'o'; |
| 76 | zOut[i++] = 't'; |
| 77 | zOut[i++] = ';'; |
| 78 | break; |
| 79 | case '\'': |
| 80 | zOut[i++] = '&'; |
| 81 | zOut[i++] = '#'; |
| 82 | zOut[i++] = '3'; |
| 83 | zOut[i++] = '9'; |
| 84 | zOut[i++] = ';'; |
| 85 | break; |
| 86 | default: |
| 87 | zOut[i++] = c; |
| 88 | break; |
| 89 | } |
| 90 | zIn++; |
| @@ -112,10 +119,15 @@ | |
| 119 | break; |
| 120 | case '"': |
| 121 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 122 | blob_append(p, """, 6); |
| 123 | j = i+1; |
| 124 | break; |
| 125 | case '\'': |
| 126 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 127 | blob_append(p, "'", 5); |
| 128 | j = i+1; |
| 129 | break; |
| 130 | } |
| 131 | } |
| 132 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 133 | } |
| 134 |
+13
-1
| --- src/encode.c | ||
| +++ src/encode.c | ||
| @@ -23,11 +23,11 @@ | ||
| 23 | 23 | /* |
| 24 | 24 | ** Make the given string safe for HTML by converting every "<" into "<", |
| 25 | 25 | ** every ">" into ">" and every "&" into "&". Return a pointer |
| 26 | 26 | ** to a new string obtained from malloc(). |
| 27 | 27 | ** |
| 28 | -** We also encode " as " so that it can appear as an argument | |
| 28 | +** We also encode " as " and ' as ' so they can appear as an argument | |
| 29 | 29 | ** to markup. |
| 30 | 30 | */ |
| 31 | 31 | char *htmlize(const char *zIn, int n){ |
| 32 | 32 | int c; |
| 33 | 33 | int i = 0; |
| @@ -74,10 +74,17 @@ | ||
| 74 | 74 | zOut[i++] = 'u'; |
| 75 | 75 | zOut[i++] = 'o'; |
| 76 | 76 | zOut[i++] = 't'; |
| 77 | 77 | zOut[i++] = ';'; |
| 78 | 78 | break; |
| 79 | + case '\'': | |
| 80 | + zOut[i++] = '&'; | |
| 81 | + zOut[i++] = '#'; | |
| 82 | + zOut[i++] = '3'; | |
| 83 | + zOut[i++] = '9'; | |
| 84 | + zOut[i++] = ';'; | |
| 85 | + break; | |
| 79 | 86 | default: |
| 80 | 87 | zOut[i++] = c; |
| 81 | 88 | break; |
| 82 | 89 | } |
| 83 | 90 | zIn++; |
| @@ -112,10 +119,15 @@ | ||
| 112 | 119 | break; |
| 113 | 120 | case '"': |
| 114 | 121 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 115 | 122 | blob_append(p, """, 6); |
| 116 | 123 | j = i+1; |
| 124 | + break; | |
| 125 | + case '\'': | |
| 126 | + if( j<i ) blob_append(p, zIn+j, i-j); | |
| 127 | + blob_append(p, "'", 5); | |
| 128 | + j = i+1; | |
| 117 | 129 | break; |
| 118 | 130 | } |
| 119 | 131 | } |
| 120 | 132 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 121 | 133 | } |
| 122 | 134 |
| --- src/encode.c | |
| +++ src/encode.c | |
| @@ -23,11 +23,11 @@ | |
| 23 | /* |
| 24 | ** Make the given string safe for HTML by converting every "<" into "<", |
| 25 | ** every ">" into ">" and every "&" into "&". Return a pointer |
| 26 | ** to a new string obtained from malloc(). |
| 27 | ** |
| 28 | ** We also encode " as " so that it can appear as an argument |
| 29 | ** to markup. |
| 30 | */ |
| 31 | char *htmlize(const char *zIn, int n){ |
| 32 | int c; |
| 33 | int i = 0; |
| @@ -74,10 +74,17 @@ | |
| 74 | zOut[i++] = 'u'; |
| 75 | zOut[i++] = 'o'; |
| 76 | zOut[i++] = 't'; |
| 77 | zOut[i++] = ';'; |
| 78 | break; |
| 79 | default: |
| 80 | zOut[i++] = c; |
| 81 | break; |
| 82 | } |
| 83 | zIn++; |
| @@ -112,10 +119,15 @@ | |
| 112 | break; |
| 113 | case '"': |
| 114 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 115 | blob_append(p, """, 6); |
| 116 | j = i+1; |
| 117 | break; |
| 118 | } |
| 119 | } |
| 120 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 121 | } |
| 122 |
| --- src/encode.c | |
| +++ src/encode.c | |
| @@ -23,11 +23,11 @@ | |
| 23 | /* |
| 24 | ** Make the given string safe for HTML by converting every "<" into "<", |
| 25 | ** every ">" into ">" and every "&" into "&". Return a pointer |
| 26 | ** to a new string obtained from malloc(). |
| 27 | ** |
| 28 | ** We also encode " as " and ' as ' so they can appear as an argument |
| 29 | ** to markup. |
| 30 | */ |
| 31 | char *htmlize(const char *zIn, int n){ |
| 32 | int c; |
| 33 | int i = 0; |
| @@ -74,10 +74,17 @@ | |
| 74 | zOut[i++] = 'u'; |
| 75 | zOut[i++] = 'o'; |
| 76 | zOut[i++] = 't'; |
| 77 | zOut[i++] = ';'; |
| 78 | break; |
| 79 | case '\'': |
| 80 | zOut[i++] = '&'; |
| 81 | zOut[i++] = '#'; |
| 82 | zOut[i++] = '3'; |
| 83 | zOut[i++] = '9'; |
| 84 | zOut[i++] = ';'; |
| 85 | break; |
| 86 | default: |
| 87 | zOut[i++] = c; |
| 88 | break; |
| 89 | } |
| 90 | zIn++; |
| @@ -112,10 +119,15 @@ | |
| 119 | break; |
| 120 | case '"': |
| 121 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 122 | blob_append(p, """, 6); |
| 123 | j = i+1; |
| 124 | break; |
| 125 | case '\'': |
| 126 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 127 | blob_append(p, "'", 5); |
| 128 | j = i+1; |
| 129 | break; |
| 130 | } |
| 131 | } |
| 132 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 133 | } |
| 134 |
+13
-1
| --- src/encode.c | ||
| +++ src/encode.c | ||
| @@ -23,11 +23,11 @@ | ||
| 23 | 23 | /* |
| 24 | 24 | ** Make the given string safe for HTML by converting every "<" into "<", |
| 25 | 25 | ** every ">" into ">" and every "&" into "&". Return a pointer |
| 26 | 26 | ** to a new string obtained from malloc(). |
| 27 | 27 | ** |
| 28 | -** We also encode " as " so that it can appear as an argument | |
| 28 | +** We also encode " as " and ' as ' so they can appear as an argument | |
| 29 | 29 | ** to markup. |
| 30 | 30 | */ |
| 31 | 31 | char *htmlize(const char *zIn, int n){ |
| 32 | 32 | int c; |
| 33 | 33 | int i = 0; |
| @@ -74,10 +74,17 @@ | ||
| 74 | 74 | zOut[i++] = 'u'; |
| 75 | 75 | zOut[i++] = 'o'; |
| 76 | 76 | zOut[i++] = 't'; |
| 77 | 77 | zOut[i++] = ';'; |
| 78 | 78 | break; |
| 79 | + case '\'': | |
| 80 | + zOut[i++] = '&'; | |
| 81 | + zOut[i++] = '#'; | |
| 82 | + zOut[i++] = '3'; | |
| 83 | + zOut[i++] = '9'; | |
| 84 | + zOut[i++] = ';'; | |
| 85 | + break; | |
| 79 | 86 | default: |
| 80 | 87 | zOut[i++] = c; |
| 81 | 88 | break; |
| 82 | 89 | } |
| 83 | 90 | zIn++; |
| @@ -112,10 +119,15 @@ | ||
| 112 | 119 | break; |
| 113 | 120 | case '"': |
| 114 | 121 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 115 | 122 | blob_append(p, """, 6); |
| 116 | 123 | j = i+1; |
| 124 | + break; | |
| 125 | + case '\'': | |
| 126 | + if( j<i ) blob_append(p, zIn+j, i-j); | |
| 127 | + blob_append(p, "'", 5); | |
| 128 | + j = i+1; | |
| 117 | 129 | break; |
| 118 | 130 | } |
| 119 | 131 | } |
| 120 | 132 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 121 | 133 | } |
| 122 | 134 |
| --- src/encode.c | |
| +++ src/encode.c | |
| @@ -23,11 +23,11 @@ | |
| 23 | /* |
| 24 | ** Make the given string safe for HTML by converting every "<" into "<", |
| 25 | ** every ">" into ">" and every "&" into "&". Return a pointer |
| 26 | ** to a new string obtained from malloc(). |
| 27 | ** |
| 28 | ** We also encode " as " so that it can appear as an argument |
| 29 | ** to markup. |
| 30 | */ |
| 31 | char *htmlize(const char *zIn, int n){ |
| 32 | int c; |
| 33 | int i = 0; |
| @@ -74,10 +74,17 @@ | |
| 74 | zOut[i++] = 'u'; |
| 75 | zOut[i++] = 'o'; |
| 76 | zOut[i++] = 't'; |
| 77 | zOut[i++] = ';'; |
| 78 | break; |
| 79 | default: |
| 80 | zOut[i++] = c; |
| 81 | break; |
| 82 | } |
| 83 | zIn++; |
| @@ -112,10 +119,15 @@ | |
| 112 | break; |
| 113 | case '"': |
| 114 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 115 | blob_append(p, """, 6); |
| 116 | j = i+1; |
| 117 | break; |
| 118 | } |
| 119 | } |
| 120 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 121 | } |
| 122 |
| --- src/encode.c | |
| +++ src/encode.c | |
| @@ -23,11 +23,11 @@ | |
| 23 | /* |
| 24 | ** Make the given string safe for HTML by converting every "<" into "<", |
| 25 | ** every ">" into ">" and every "&" into "&". Return a pointer |
| 26 | ** to a new string obtained from malloc(). |
| 27 | ** |
| 28 | ** We also encode " as " and ' as ' so they can appear as an argument |
| 29 | ** to markup. |
| 30 | */ |
| 31 | char *htmlize(const char *zIn, int n){ |
| 32 | int c; |
| 33 | int i = 0; |
| @@ -74,10 +74,17 @@ | |
| 74 | zOut[i++] = 'u'; |
| 75 | zOut[i++] = 'o'; |
| 76 | zOut[i++] = 't'; |
| 77 | zOut[i++] = ';'; |
| 78 | break; |
| 79 | case '\'': |
| 80 | zOut[i++] = '&'; |
| 81 | zOut[i++] = '#'; |
| 82 | zOut[i++] = '3'; |
| 83 | zOut[i++] = '9'; |
| 84 | zOut[i++] = ';'; |
| 85 | break; |
| 86 | default: |
| 87 | zOut[i++] = c; |
| 88 | break; |
| 89 | } |
| 90 | zIn++; |
| @@ -112,10 +119,15 @@ | |
| 119 | break; |
| 120 | case '"': |
| 121 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 122 | blob_append(p, """, 6); |
| 123 | j = i+1; |
| 124 | break; |
| 125 | case '\'': |
| 126 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 127 | blob_append(p, "'", 5); |
| 128 | j = i+1; |
| 129 | break; |
| 130 | } |
| 131 | } |
| 132 | if( j<i ) blob_append(p, zIn+j, i-j); |
| 133 | } |
| 134 |
+2
| --- src/markdown_html.c | ||
| +++ src/markdown_html.c | ||
| @@ -72,10 +72,12 @@ | ||
| 72 | 72 | BLOB_APPEND_LITERAL(ob, ">"); |
| 73 | 73 | }else if( data[i]=='&' ){ |
| 74 | 74 | BLOB_APPEND_LITERAL(ob, "&"); |
| 75 | 75 | }else if( data[i]=='"' ){ |
| 76 | 76 | BLOB_APPEND_LITERAL(ob, """); |
| 77 | + }else if( data[i]=='\'' ){ | |
| 78 | + BLOB_APPEND_LITERAL(ob, "'"); | |
| 77 | 79 | }else{ |
| 78 | 80 | break; |
| 79 | 81 | } |
| 80 | 82 | i++; |
| 81 | 83 | } |
| 82 | 84 |
| --- src/markdown_html.c | |
| +++ src/markdown_html.c | |
| @@ -72,10 +72,12 @@ | |
| 72 | BLOB_APPEND_LITERAL(ob, ">"); |
| 73 | }else if( data[i]=='&' ){ |
| 74 | BLOB_APPEND_LITERAL(ob, "&"); |
| 75 | }else if( data[i]=='"' ){ |
| 76 | BLOB_APPEND_LITERAL(ob, """); |
| 77 | }else{ |
| 78 | break; |
| 79 | } |
| 80 | i++; |
| 81 | } |
| 82 |
| --- src/markdown_html.c | |
| +++ src/markdown_html.c | |
| @@ -72,10 +72,12 @@ | |
| 72 | BLOB_APPEND_LITERAL(ob, ">"); |
| 73 | }else if( data[i]=='&' ){ |
| 74 | BLOB_APPEND_LITERAL(ob, "&"); |
| 75 | }else if( data[i]=='"' ){ |
| 76 | BLOB_APPEND_LITERAL(ob, """); |
| 77 | }else if( data[i]=='\'' ){ |
| 78 | BLOB_APPEND_LITERAL(ob, "'"); |
| 79 | }else{ |
| 80 | break; |
| 81 | } |
| 82 | i++; |
| 83 | } |
| 84 |
+2
| --- src/markdown_html.c | ||
| +++ src/markdown_html.c | ||
| @@ -72,10 +72,12 @@ | ||
| 72 | 72 | BLOB_APPEND_LITERAL(ob, ">"); |
| 73 | 73 | }else if( data[i]=='&' ){ |
| 74 | 74 | BLOB_APPEND_LITERAL(ob, "&"); |
| 75 | 75 | }else if( data[i]=='"' ){ |
| 76 | 76 | BLOB_APPEND_LITERAL(ob, """); |
| 77 | + }else if( data[i]=='\'' ){ | |
| 78 | + BLOB_APPEND_LITERAL(ob, "'"); | |
| 77 | 79 | }else{ |
| 78 | 80 | break; |
| 79 | 81 | } |
| 80 | 82 | i++; |
| 81 | 83 | } |
| 82 | 84 |
| --- src/markdown_html.c | |
| +++ src/markdown_html.c | |
| @@ -72,10 +72,12 @@ | |
| 72 | BLOB_APPEND_LITERAL(ob, ">"); |
| 73 | }else if( data[i]=='&' ){ |
| 74 | BLOB_APPEND_LITERAL(ob, "&"); |
| 75 | }else if( data[i]=='"' ){ |
| 76 | BLOB_APPEND_LITERAL(ob, """); |
| 77 | }else{ |
| 78 | break; |
| 79 | } |
| 80 | i++; |
| 81 | } |
| 82 |
| --- src/markdown_html.c | |
| +++ src/markdown_html.c | |
| @@ -72,10 +72,12 @@ | |
| 72 | BLOB_APPEND_LITERAL(ob, ">"); |
| 73 | }else if( data[i]=='&' ){ |
| 74 | BLOB_APPEND_LITERAL(ob, "&"); |
| 75 | }else if( data[i]=='"' ){ |
| 76 | BLOB_APPEND_LITERAL(ob, """); |
| 77 | }else if( data[i]=='\'' ){ |
| 78 | BLOB_APPEND_LITERAL(ob, "'"); |
| 79 | }else{ |
| 80 | break; |
| 81 | } |
| 82 | i++; |
| 83 | } |
| 84 |
+2
| --- src/markdown_html.c | ||
| +++ src/markdown_html.c | ||
| @@ -72,10 +72,12 @@ | ||
| 72 | 72 | BLOB_APPEND_LITERAL(ob, ">"); |
| 73 | 73 | }else if( data[i]=='&' ){ |
| 74 | 74 | BLOB_APPEND_LITERAL(ob, "&"); |
| 75 | 75 | }else if( data[i]=='"' ){ |
| 76 | 76 | BLOB_APPEND_LITERAL(ob, """); |
| 77 | + }else if( data[i]=='\'' ){ | |
| 78 | + BLOB_APPEND_LITERAL(ob, "'"); | |
| 77 | 79 | }else{ |
| 78 | 80 | break; |
| 79 | 81 | } |
| 80 | 82 | i++; |
| 81 | 83 | } |
| 82 | 84 |
| --- src/markdown_html.c | |
| +++ src/markdown_html.c | |
| @@ -72,10 +72,12 @@ | |
| 72 | BLOB_APPEND_LITERAL(ob, ">"); |
| 73 | }else if( data[i]=='&' ){ |
| 74 | BLOB_APPEND_LITERAL(ob, "&"); |
| 75 | }else if( data[i]=='"' ){ |
| 76 | BLOB_APPEND_LITERAL(ob, """); |
| 77 | }else{ |
| 78 | break; |
| 79 | } |
| 80 | i++; |
| 81 | } |
| 82 |
| --- src/markdown_html.c | |
| +++ src/markdown_html.c | |
| @@ -72,10 +72,12 @@ | |
| 72 | BLOB_APPEND_LITERAL(ob, ">"); |
| 73 | }else if( data[i]=='&' ){ |
| 74 | BLOB_APPEND_LITERAL(ob, "&"); |
| 75 | }else if( data[i]=='"' ){ |
| 76 | BLOB_APPEND_LITERAL(ob, """); |
| 77 | }else if( data[i]=='\'' ){ |
| 78 | BLOB_APPEND_LITERAL(ob, "'"); |
| 79 | }else{ |
| 80 | break; |
| 81 | } |
| 82 | i++; |
| 83 | } |
| 84 |