cosmopolitan/net/http/escapejsstringliteral.c

/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8                                :vi│
╞══════════════════════════════════════════════════════════════════════════════╡
│ Copyright 2021 Justine Alexandra Roberts Tunney                              │
│                                                                              │
│ Permission to use, copy, modify, and/or distribute this software for         │
│ any purpose with or without fee is hereby granted, provided that the         │
│ above copyright notice and this permission notice appear in all copies.      │
│                                                                              │
│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL                │
│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED                │
│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE             │
│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL         │
│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR        │
│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER               │
│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
│ PERFORMANCE OF THIS SOFTWARE.                                                │
╚─────────────────────────────────────────────────────────────────────────────*/
#include "libc/str/thompike.h"
#include "libc/str/utf16.h"
#include "libc/x/x.h"
#include "net/http/escape.h"

/**
 * Escapes UTF-8 data for JavaScript or JSON string literal.
 *
 * HTML entities and forward slash are escaped too for added safety.
 *
 * We assume the UTF-8 is well-formed and can be represented as UTF-16.
 * Things that can't be decoded will fall back to binary. Things that
 * can't be encoded will use invalid codepoint markers. This function is
 * agnostic to numbers that have been used with malicious intent in the
 * past under buggy software. Noncanonical encodings such as overlong
 * NUL are canonicalized as NUL.
 */
struct EscapeResult EscapeJsStringLiteral(const char *data, size_t size) {
  char *p;
  uint64_t w;
  unsigned i, n;
  wint_t x, a, b;
  const char *d, *e;
  struct EscapeResult r;
  d = data;
  e = data + size;
  p = r.data = xmalloc(size * 6 + 6 + 1);
  while (d < e) {
    x = *d++ & 0xff;
    if (x >= 0300) {
      a = ThomPikeByte(x);
      n = ThomPikeLen(x) - 1;
      if (d + n <= e) {
        for (i = 0;;) {
          b = d[i] & 0xff;
          if (!ThomPikeCont(b)) break;
          a = ThomPikeMerge(a, b);
          if (++i == n) {
            x = a;
            d += i;
            break;
          }
        }
      }
    }
    switch (x) {
      case ' ':
      case '!':
      case '#':
      case '$':
      case '%':
      case '(':
      case ')':
      case '*':
      case '+':
      case ',':
      case '-':
      case '.':
      case '0':
      case '1':
      case '2':
      case '3':
      case '4':
      case '5':
      case '6':
      case '7':
      case '8':
      case '9':
      case ':':
      case ';':
      case '?':
      case '@':
      case 'A':
      case 'B':
      case 'C':
      case 'D':
      case 'E':
      case 'F':
      case 'G':
      case 'H':
      case 'I':
      case 'J':
      case 'K':
      case 'L':
      case 'M':
      case 'N':
      case 'O':
      case 'P':
      case 'Q':
      case 'R':
      case 'S':
      case 'T':
      case 'U':
      case 'V':
      case 'W':
      case 'X':
      case 'Y':
      case 'Z':
      case '[':
      case ']':
      case '^':
      case '_':
      case '`':
      case 'a':
      case 'b':
      case 'c':
      case 'd':
      case 'e':
      case 'f':
      case 'g':
      case 'h':
      case 'i':
      case 'j':
      case 'k':
      case 'l':
      case 'm':
      case 'n':
      case 'o':
      case 'p':
      case 'q':
      case 'r':
      case 's':
      case 't':
      case 'u':
      case 'v':
      case 'w':
      case 'x':
      case 'y':
      case 'z':
      case '{':
      case '|':
      case '}':
      case '~':
        *p++ = x;
        break;
      case '\t':
        p[0] = '\\';
        p[1] = 't';
        p += 2;
        break;
      case '\n':
        p[0] = '\\';
        p[1] = 'n';
        p += 2;
        break;
      case '\r':
        p[0] = '\\';
        p[1] = 'r';
        p += 2;
        break;
      case '\f':
        p[0] = '\\';
        p[1] = 'f';
        p += 2;
        break;
      case '\\':
        p[0] = '\\';
        p[1] = '\\';
        p += 2;
        break;
      case '/':
        p[0] = '\\';
        p[1] = '/';
        p += 2;
        break;
      case '"':
        p[0] = '\\';
        p[1] = '"';
        p += 2;
        break;
      case '\'':
        p[0] = '\\';
        p[1] = '\'';
        p += 2;
        break;
      case '<':
      case '>':
      case '&':
      case '=':
      default:
        w = EncodeUtf16(x);
        do {
          p[0] = '\\';
          p[1] = 'u';
          p[2] = "0123456789abcdef"[(w & 0xF000) >> 014];
          p[3] = "0123456789abcdef"[(w & 0x0F00) >> 010];
          p[4] = "0123456789abcdef"[(w & 0x00F0) >> 004];
          p[5] = "0123456789abcdef"[(w & 0x000F) >> 000];
          p += 6;
        } while ((w >>= 16));
        break;
    }
  }
  r.size = p - r.data;
  r.data = xrealloc(r.data, r.size + 1);
  r.data[r.size] = '\0';
  return r;
}