cvs commit: modperl-2.0/xs/maps apache_types.map
stas02/03/25 17:52:12 Modified:xs/maps apache_types.map Log: add the typemap for 'double' needed by xs_generate Revision ChangesPath 1.7 +1 -0 modperl-2.0/xs/maps/apache_types.map Index: apache_types.map === RCS file: /home/cvs/modperl-2.0/xs/maps/apache_types.map,v retrieving revision 1.6 retrieving revision 1.7 diff -u -r1.6 -r1.7 --- apache_types.map 10 Sep 2001 06:42:51 - 1.6 +++ apache_types.map 26 Mar 2002 01:52:12 - 1.7 -50,6 +50,7 long int| IV unsigned long | UV unsigned| UV +double | NV char * | PV const char * | PV
cvs commit: modperl-2.0/xs/Apache/Log Apache__Log.h
dougm 02/03/25 19:37:47
Modified:xs/Apache/Log Apache__Log.h
Log:
workaround win32/5.6.1 bug which crashes when using PL_sv_no with do_join
Revision ChangesPath
1.9 +24 -6 modperl-2.0/xs/Apache/Log/Apache__Log.h
Index: Apache__Log.h
===
RCS file: /home/cvs/modperl-2.0/xs/Apache/Log/Apache__Log.h,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- Apache__Log.h 4 May 2001 06:31:37 - 1.8
+++ Apache__Log.h 26 Mar 2002 03:37:47 - 1.9
-102,6 +102,27
#define mpxs_Apache__Server_log(sv) \
mpxs_Apache__Log_log(aTHX_ sv, MP_LOG_SERVER)
+static MP_INLINE SV *modperl_perl_do_join(pTHX_ SV **mark, SV **sp)
+{
+SV *sv = newSV(0);
+SV *delim;
+#ifdef WIN32
+/* XXX: using PL_sv_no crashes on win32 with 5.6.1 */
+delim = newSVpv(, 0);
+#else
+delim = SvREFCNT_inc(PL_sv_no);
+#endif
+
+do_join(sv, delim, mark, sp);
+
+SvREFCNT_dec(delim);
+
+return sv;
+}
+
+#define my_do_join(m, s) \
+ modperl_perl_do_join(aTHX_ (m), (s))
+
static XS(MPXS_Apache__Log_dispatch)
{
dXSARGS;
-115,8 +136,7
}
if (items 2) {
-msgsv = newSV(0);
-do_join(msgsv, PL_sv_no, MARK+1, SP);
+msgsv = my_do_join(MARK+1, SP);
}
else {
msgsv = ST(1);
-213,8 +233,7
status = (apr_status_t)SvIV(ST(4));
if (items 6) {
-msgsv = newSV(0);
-do_join(msgsv, PL_sv_no, MARK+5, SP);
+msgsv = my_do_join(MARK+5, SP);
}
else {
msgsv = ST(5);
-279,8 +298,7
}
if (items 1+i) {
-sv = newSV(0);
-do_join(sv, PL_sv_no, MARK+i, SP); /* $sv = join '', _[1..$#_] */
+sv = my_do_join(MARK+i, SP); /* $sv = join '', _[1..$#_] */
errstr = SvPV(sv,n_a);
}
else {
Re: cvs commit: modperl/t/net/perl util.pl
--On Sunday, March 24, 2002 21:57:54 + [EMAIL PROTECTED] wrote: dougm 02/03/24 13:57:53 Modified:.Changes STATUS src/modules/perl Util.xs t/net/perl util.pl Log: Submitted by: Geoff Young [EMAIL PROTECTED] Reviewed by:dougm properly escape highbit chars in Apache::Utils::escape_html This is uncool for those of us using a non-ASCII encoding and sending out lots of characters with the 8th bit set, e.g. in a French page many accented characters will be replaced by 6-byte sequences. If I'm sending out Content-type: text/html; charset=ISO-8859-1, and calling escape_html to escape '', '' and the like, I'm going to be serving quite a lot more bytes than before this patch. However escape_html () has no clue as to what the character set is, and whether it has been correctly specified in the Content-Type. It has also be mentionned here that escape_html is only valid for single-byte encodings. So this patch does the right thing to escape the odd 8 bit char in a mostly ASCII output, but users of other charsets should be warned not to use it. I use HTML::Entities::encode($_[0], '') myself. Therefore I propose a doc patch to clear this up: Index: Util.pm === RCS file: /home/cvs/modperl/Util/Util.pm,v retrieving revision 1.8 diff -u -r1.8 Util.pm --- Util.pm 4 Mar 2000 20:55:47 - 1.8 +++ Util.pm 25 Mar 2002 18:19:37 - @@ -68,6 +68,13 @@ my $esc = Apache::Util::escape_html($html); +This function is unaware of its argument's character set and encoding. +It assumes a single-byte encoding and escapes all characters with the +8th bit set. Do not use it with multi-byte encodings such as utf8. +When using a single byte non-ASCII encoding such as ISO-8859-1, +consider specifying the character set in the Content-Type header, +and using HTML::Entities to avoid unnecessary escaping. + =item escape_uri This function replaces all unsafe characters in the $string with their -- Eric Cholet
Re: cvs commit: modperl/t/net/perl util.pl
i had a bad feeling about this. we should not be implementing escape_html to begin with, the functionality should all be in apache. i'm going to back out the patch. anybody care to make a doc patch to explain the problems with escape_html before the patch went in? thanks.
Re: cvs commit: modperl/t/net/perl util.pl
Doug MacEachern wrote: i had a bad feeling about this. we should not be implementing escape_html to begin with, the functionality should all be in apache. i'm going to back out the patch. sounds wise, especially considering people like Eric will end up with larger pages as a result, while the patch fixes a rather obscure vunerability, for which other solutions (HTML::Entities) are available. anybody care to make a doc patch to explain the problems with escape_html before the patch went in? I nominate robin, since I forget how it came up in the first place :) IIRC is was due to this post http://www.xray.mpe.mpg.de/mailing-lists/perl5-porters/2000-03/msg00750.html and specifically an exploit involving browsers incorrectly assuming 0x8b as a and 0x9b as a , thus creating a way around escape_html(). Robin, does that accurately summarize it? it's been far too long for me :) --Geoff
Re: cvs commit: modperl/t/net/perl util.pl
--On Monday, March 25, 2002 10:29:11 -0800 Doug MacEachern [EMAIL PROTECTED] wrote: i had a bad feeling about this. we should not be implementing escape_html to begin with, the functionality should all be in apache. i'm going to back out the patch. anybody care to make a doc patch to explain the problems with escape_html before the patch went in? thanks. I believe the patch is useful though, in cases where the charset is not explicitely specified and there's an odd character with the 8th bit set it will now do the right thing. I guess a lot of US coders would fall in that situation... I suppose it's faster than HTML::Entities (I haven't benchmarked it though). So I suspect the patch will fix more situations than it breaks: if using a single-byte non-ASCII encoding, it doesn't actually break anything, just adds bloat. If using a multi-byte encoding escape_html was broken/inapplicable already. -- Eric Cholet
cvs commit: modperl/t/net/perl util.pl
dougm 02/03/25 10:45:23
Modified:.Changes
src/modules/perl Util.xs
t/net/perl util.pl
Log:
backing out change: properly escape highbit chars in Apache::Utils::escape_html
Revision ChangesPath
1.639 +0 -4 modperl/Changes
Index: Changes
===
RCS file: /home/cvs/modperl/Changes,v
retrieving revision 1.638
retrieving revision 1.639
diff -u -r1.638 -r1.639
--- Changes 25 Mar 2002 02:57:59 - 1.638
+++ Changes 25 Mar 2002 18:45:23 - 1.639
@@ -26,10 +26,6 @@
properly deal with $r-status codes (e.g. redirect) in
Apache::RegistryNG [Geoff Young [EMAIL PROTECTED]]
-properly escape highbit chars in Apache::Utils::escape_html
-[Geoff Young [EMAIL PROTECTED],
-Robin Berjon [EMAIL PROTECTED]]
-
allow $r-auth_name and $r-auth_type to be set on win32
[John Kelly [EMAIL PROTECTED]]
1.11 +1 -8 modperl/src/modules/perl/Util.xs
Index: Util.xs
===
RCS file: /home/cvs/modperl/src/modules/perl/Util.xs,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- Util.xs 24 Mar 2002 21:57:53 - 1.10
+++ Util.xs 25 Mar 2002 18:45:23 - 1.11
@@ -32,9 +32,6 @@
return sv;
}
-#define IS_HIGHBIT_CHAR(b) \
- ( (((unsigned char)(b)) 126) (((unsigned char)(b)) = 255) )
-
static SV *my_escape_html(char *s)
{
int i, j;
@@ -46,7 +43,7 @@
j += 3;
else if (s[i] == '')
j += 4;
-else if (s[i] == '' || IS_HIGHBIT_CHAR(s[i]))
+else if (s[i] == '')
j += 5;
if (j == 0)
@@ -70,10 +67,6 @@
memcpy(SvPVX(x)[j], quot;, 6);
j += 5;
}
-else if (IS_HIGHBIT_CHAR(s[i])) {
-sprintf(SvPVX(x)[j], #%d;, (unsigned char)s[i]);
-j += 5;
-}
else
SvPVX(x)[j] = s[i];
1.13 +1 -5 modperl/t/net/perl/util.pl
Index: util.pl
===
RCS file: /home/cvs/modperl/t/net/perl/util.pl,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- util.pl 24 Mar 2002 21:57:53 - 1.12
+++ util.pl 25 Mar 2002 18:45:23 - 1.13
@@ -2,7 +2,7 @@
use Apache::test;
$|++;
my $i = 0;
-my $tests = 8;
+my $tests = 7;
my $r = shift;
$r-send_http_header('text/plain');
@@ -61,10 +61,6 @@
/body
/html
EOF
-
-#XXX: this test could be more robust, but its better than nothing
-my $c = Apache::Util::escape_html(\x8b);
-test ++$i, $c =~ /^\#\d{3,3}\;$/;
my $txt = No html tags in here at all;
my $etxt = Apache::Util::escape_html($txt);
