Skip to content

Commit 7284564

Browse files
dlemstradlemstra
committed
Properly escape the strings that are written as raw html (GHSA-rw6c-xp26-225v)
1 parent 661f4e6 commit 7284564

File tree

1 file changed

+39
-25
lines changed

1 file changed

+39
-25
lines changed

‎coders/html.c‎

Lines changed: 39 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,21 @@ ModuleExport void UnregisterHTMLImage(void)
210210
%
211211
*/
212212

213+
static void WriteHtmlEncodedString(Image *image,const char* value)
214+
{
215+
char
216+
*encoded_value;
217+
218+
encoded_value=AcquireString(value);
219+
(void) SubstituteString(&encoded_value,"<","&lt;");
220+
(void) SubstituteString(&encoded_value,">","&gt;");
221+
(void) SubstituteString(&encoded_value,"&","&amp;");
222+
(void) SubstituteString(&encoded_value,"\"","&quot;");
223+
(void) SubstituteString(&encoded_value,"'","&apos;");
224+
WriteBlobString(image,encoded_value);
225+
encoded_value=DestroyString(encoded_value);
226+
}
227+
213228
static ssize_t WriteURLComponent(Image *image,const int c)
214229
{
215230
char
@@ -320,29 +335,29 @@ static MagickBooleanType WriteHTMLImage(const ImageInfo *image_info,
320335
"\"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">\n");
321336
(void) WriteBlobString(image,"<html>\n");
322337
(void) WriteBlobString(image,"<head>\n");
338+
(void) WriteBlobString(image,"<title>");
323339
value=GetImageProperty(image,"label");
324340
if (value != (const char *) NULL)
325-
(void) FormatLocaleString(buffer,MaxTextExtent,"<title>%s</title>\n",
326-
value);
341+
WriteHtmlEncodedString(image,value);
327342
else
328343
{
329344
GetPathComponent(filename,BasePath,basename);
330-
(void) FormatLocaleString(buffer,MaxTextExtent,
331-
"<title>%s</title>\n",basename);
345+
WriteHtmlEncodedString(image,basename);
332346
}
333-
(void) WriteBlobString(image,buffer);
347+
(void) WriteBlobString(image,"</title>\n");
334348
(void) WriteBlobString(image,"</head>\n");
335349
(void) WriteBlobString(image,"<body style=\"text-align: center;\">\n");
336-
(void) FormatLocaleString(buffer,MaxTextExtent,"<h1>%s</h1>\n",
337-
image->filename);
338-
(void) WriteBlobString(image,buffer);
350+
(void) WriteBlobString(image,"<h1>");
351+
WriteHtmlEncodedString(image,image->filename);
352+
(void) WriteBlobString(image,"</h1>");
339353
(void) WriteBlobString(image,"<div>\n");
340354
(void) CopyMagickString(filename,image->filename,MaxTextExtent);
341355
AppendImageFormat("png",filename);
342-
(void) FormatLocaleString(buffer,MaxTextExtent,"<img usemap=\"#%s\" "
343-
"src=\"%s\" style=\"border: 0;\" alt=\"Image map\" />\n",mapname,
344-
filename);
345-
(void) WriteBlobString(image,buffer);
356+
(void) WriteBlobString(image,"<img usemap=\"#");
357+
WriteHtmlEncodedString(image,mapname);
358+
(void) WriteBlobString(image,"\" src=\"");
359+
WriteHtmlEncodedString(image,filename);
360+
(void) WriteBlobString(image,"\" style=\"border: 0;\" alt=\"Image map\" />\n");
346361
/*
347362
Determine the size and location of each image tile.
348363
*/
@@ -352,17 +367,18 @@ static MagickBooleanType WriteHTMLImage(const ImageInfo *image_info,
352367
/*
353368
Write an image map.
354369
*/
355-
(void) FormatLocaleString(buffer,MaxTextExtent,
356-
"<map id=\"%s\" name=\"%s\">\n",mapname,mapname);
357-
(void) WriteBlobString(image,buffer);
358-
(void) FormatLocaleString(buffer,MaxTextExtent," <area href=\"%s",url);
359-
(void) WriteBlobString(image,buffer);
370+
(void) WriteBlobString(image,"<map id=\"");
371+
WriteHtmlEncodedString(image,mapname);
372+
(void) WriteBlobString(image,"\" name=\"");
373+
WriteHtmlEncodedString(image,mapname);
374+
(void) WriteBlobString(image,"\">\n<area href=\"");
375+
WriteHtmlEncodedString(image,url);
360376
if (image->directory == (char *) NULL)
361377
{
378+
WriteHtmlEncodedString(image,image->filename);
362379
(void) FormatLocaleString(buffer,MaxTextExtent,
363-
"%s\" shape=\"rect\" coords=\"0,0,%.20g,%.20g\" alt=\"\" />\n",
364-
image->filename,(double) geometry.width-1,(double) geometry.height-
365-
1);
380+
"\" shape=\"rect\" coords=\"0,0,%.20g,%.20g\" alt=\"\" />\n",
381+
(double) geometry.width-1,(double) geometry.height-1);
366382
(void) WriteBlobString(image,buffer);
367383
}
368384
else
@@ -378,9 +394,9 @@ static MagickBooleanType WriteHTMLImage(const ImageInfo *image_info,
378394
(void) WriteBlobString(image,buffer);
379395
if (*(p+1) != '\0')
380396
{
381-
(void) FormatLocaleString(buffer,MaxTextExtent,
382-
" <area href=%s\"",url);
383-
(void) WriteBlobString(image,buffer);
397+
(void) WriteBlobString(image," <area href=\"");
398+
WriteHtmlEncodedString(image,url);
399+
(void) WriteBlobString(image,"\"");
384400
}
385401
geometry.x+=(ssize_t) geometry.width;
386402
if ((geometry.x+4) >= (ssize_t) image->columns)
@@ -390,15 +406,13 @@ static MagickBooleanType WriteHTMLImage(const ImageInfo *image_info,
390406
}
391407
}
392408
(void) WriteBlobString(image,"</map>\n");
393-
(void) CopyMagickString(filename,image->filename,MaxTextExtent);
394409
(void) WriteBlobString(image,"</div>\n");
395410
(void) WriteBlobString(image,"</body>\n");
396411
(void) WriteBlobString(image,"</html>\n");
397412
(void) CloseBlob(image);
398413
/*
399414
Write the image as PNG.
400415
*/
401-
(void) CopyMagickString(image->filename,filename,MaxTextExtent);
402416
AppendImageFormat("png",image->filename);
403417
next=GetNextImageInList(image);
404418
image->next=NewImageList();

0 commit comments

Comments
 (0)