commit b1868d8

New function encode_html_strict().

 1@@ -260,7 +260,7 @@ xs_str *sanitize(const char *content)
 2 }
 3 
 4 
 5-xs_str *encode_html(const char *str)
 6+xs_str *encode_html_strict(const char *str)
 7 /* escapes html characters */
 8 {
 9     xs_str *encoded = xs_replace(str, "&", "&");
10@@ -269,6 +269,15 @@ xs_str *encode_html(const char *str)
11     encoded = xs_replace_i(encoded, "\"", """);
12     encoded = xs_replace_i(encoded, "'", "'");
13 
14+    return encoded;
15+}
16+
17+
18+xs_str *encode_html(const char *str)
19+/* escapes html characters */
20+{
21+    xs_str *encoded = encode_html_strict(str);
22+
23     /* Restore only <br>. Probably safe. Let's hope nothing goes wrong with this. */
24     encoded = xs_replace_i(encoded, "&lt;br&gt;", "<br>");
25 

 1@@ -2075,10 +2075,10 @@ int html_get_handler(const xs_dict *req, const char *q_path,
 2         xs *bio   = not_really_markdown(xs_dict_get(snac.config, "bio"), NULL);
 3         char *p, *v;
 4 
 5-        xs *es1 = encode_html(xs_dict_get(snac.config, "name"));
 6-        xs *es2 = encode_html(snac.uid);
 7-        xs *es3 = encode_html(xs_dict_get(srv_config, "host"));
 8-        xs *es4 = encode_html(bio);
 9+        xs *es1 = encode_html_strict(xs_dict_get(snac.config, "name"));
10+        xs *es2 = encode_html_strict(snac.uid);
11+        xs *es3 = encode_html_strict(xs_dict_get(srv_config, "host"));
12+        xs *es4 = encode_html_strict(bio);
13         rss = xs_fmt(
14             "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
15             "<rss version=\"0.91\">\n"
16@@ -2106,7 +2106,7 @@ int html_get_handler(const xs_dict *req, const char *q_path,
17             if (!xs_startswith(id, snac.actor))
18                 continue;
19 
20-            xs *content = sanitize(xs_dict_get(msg, "content"));
21+            xs *content = encode_html_strict(xs_dict_get(msg, "content"));
22 
23             // We SHOULD only use sanitized one for description.
24             // So, only encode for feed title, while the description just keep it sanitized as is.
25@@ -2115,7 +2115,7 @@ int html_get_handler(const xs_dict *req, const char *q_path,
26             xs *title   = xs_str_new(NULL);
27             int i;
28 
29-            for (i = 0; es_title[i] && es_title[i] != '\n' && i < 50; i++)
30+            for (i = 0; es_title[i] && es_title[i] != '\n' && es_title[i] != '&' && i < 50; i++)
31                 title = xs_append_m(title, &es_title[i], 1);
32 
33             xs *s = xs_fmt(

1@@ -262,6 +262,7 @@ int activitypub_post_handler(const xs_dict *req, const char *q_path,
2 
3 xs_str *not_really_markdown(const char *content, xs_list **attach);
4 xs_str *sanitize(const char *content);
5+xs_str *encode_html_strict(const char *str);
6 xs_str *encode_html(const char *str);
7 
8 xs_str *html_timeline(snac *user, const xs_list *list, int local, int skip, int show, int show_more);