commit 49f2f49

Strip dangerous control codes in sanitize().

 1@@ -179,11 +179,20 @@ d_char *sanitize(const char *content)
 2     xs *sl;
 3     int n = 0;
 4     char *p, *v;
 5+    xs *content2 = xs_dup(content);
 6 
 7-    sl = xs_regex_split(content, "</?[^>]+>");
 8+    /* strip dangerous control codes */
 9+    for (n = 0; content2[n]; n++) {
10+        if (content2[n] > 0x0   && content2[n] < 0x20 &&
11+            content2[n] != '\r' && content2[n] != '\n')
12+            content2[n] = ' ';
13+    }
14+
15+    sl = xs_regex_split(content2, "</?[^>]+>");
16 
17     p = sl;
18 
19+    n = 0;
20     while (xs_list_iter(&p, &v)) {
21         if (n & 0x1) {
22             xs *s1  = xs_strip_i(xs_crop_i(xs_dup(v), v[1] == '/' ? 2 : 1, -1));