Regarding Cactus bug report 1632 "HTTPD contains buffer overflows"

1) Got rid of most strcat/sprintf into automatic array, replaced
   with a String module that allocates dynamic memory on the heap.

2) Went a long way toward initializing all variables.

3) Tested:  Ran two copies with same parfile except different port,
   one with my changes, one with original.  Went through different
   kinds of pages by hand, checked by eye.

4) Tried to make HTML XHTML 1.0-compliant.  Checked with Amaya.

   One problem:  How to deal with raw less-than characters, etc.
   Made a function to convert them to HTML Character Entities,
   but isn't clear this will work properly in the forms.  So
   I left these symbols in the forms.

5) Also checked with more primitive browsers, lynx and dillo.

6) Marked a few instances of questionable code with 'SW'

To do
-----
Document a few new functions, esp. in Content.c


git-svn-id: http://svn.cactuscode.org/arrangements/CactusConnect/HTTPD/trunk@187 1faa4e14-9dd3-4be0-9f0e-ffe519881164

1 files changed, 32 insertions, 30 deletions

diff --git a/src/Cookies.c b/src/Cookies.c
index 9e0f6d1..f4cf36d 100644
--- a/src/Cookies.c
+++ b/src/Cookies.c
@@ -17,6 +17,8 @@
 
 #include "http_Request.h"
 #include "http_Cookies.h"
+#define STRING_NAMESPACE 1
+#include "SString.h"
 
 static const char *rcsid = "$Header$";
 
@@ -64,34 +66,41 @@ int HTTP_CookieSend(httpRequest *request,
                     const char *expires,
                     int secure)
 {
-  char message[8000];
+  String *message = String_New();
 
-  sprintf(message, "Set-Cookie: %s=%s", name, value);
+  SetToCString(message, "Set-Cookie: ");
+  ConcatCString(message, name);
+  ConcatCString(message, "=");
+  ConcatCString(message, value);
 
   if(path)
   {
-    sprintf(message, "%s; path=%s", message, path);
+    ConcatCString(message, "; path=");
+    ConcatCString(message, path);
   }
 
   if(domain)
   {
-    sprintf(message,"%s; domain=%s", message, domain);
+    ConcatCString(message, "; domain=");
+    ConcatCString(message, domain);
   }
 
   if(expires)
   {
-    sprintf(message,"%s; expires=%s", message, expires);
+    ConcatCString(message, "; expires=");
+    ConcatCString(message, expires);
   }
 
   if(secure)
   {
-    sprintf(message,"%s; secure", message);
+    ConcatCString(message, "; secure");
   }    
 
-  strcat(message, "\r\n");
+  ConcatCString(message, "\r\n");
 
-  HTTP_Write(request, message, strlen(message));
+  Send_HTTP_String(request, message);
 
+  String_Delete( message );
   return 0;
 }
 
@@ -113,23 +122,26 @@ int HTTP_CookieCancel(httpRequest *request,
                       const char *name, 
                       const char *path)
 {
-  char message[8000];
+  String *message = String_New();
 
   /* Clear the value */
-  sprintf(message, "Set-Cookie: %s=", name);
+  SetToCString(message, "Set-Cookie: ");
+  ConcatCString(message, name);
+  ConcatCString(message, "=");
 
   if(path)
   {
-    sprintf(message, "%s; path=%s", message, path);
+    ConcatCString(message, "; path=");
+    ConcatCString(message, path);
   }
 
   /* Pick a date in the past */
-  sprintf(message,"%s; expires Sun Sep 17 21:57:45 CEST 2000", message);
+  ConcatCString(message, "; expires Sun Sep 17 21:57:45 CEST 2000");
+  ConcatCString(message, "\r\n");
 
-  strcat(message, "\r\n");
-
-  HTTP_Write(request, message, strlen(message));
+  Send_HTTP_String(request, message);
 
+  String_Delete( message );
   return 0;
 }
 
@@ -150,22 +162,14 @@ int HTTP_CookieCancel(httpRequest *request,
 char *HTTP_CookieGet(httpRequest *request,
                      const char *name)
 {
-  char *retval;
-  const char *header;
-  char *position;
-  char *copy;
-  char *start;
-
+  char *retval = NULL;
   /* Get the cookie header */
-  header = HTTP_HeaderValue(request,"Cookie");
-
-  retval = NULL;
+  const char *header = HTTP_HeaderValue(request,"Cookie");
 
   if(header)
   {
-    copy = Util_Strdup(header);
-    
-    position = copy;
+    char *copy = Util_Strdup(header);
+    char *position = copy;
     
     /* Search for name=value */
     while((position = strstr(position, name)) != NULL)
@@ -173,7 +177,7 @@ char *HTTP_CookieGet(httpRequest *request,
       position += strlen(name);
       if(*position == '=')
       {
-        start = position+1;
+        char *start = position+1;
 
         position=strstr(start, ";");
 
@@ -185,11 +189,9 @@ char *HTTP_CookieGet(httpRequest *request,
         break;
       }
     }
-
     free(copy);
   }
 
-
   return retval;
 }