diff options
| author | Mark Michelson <mmichelson@digium.com> | 2014-05-07 15:29:18 +0000 |
|---|---|---|
| committer | Mark Michelson <mmichelson@digium.com> | 2014-05-07 15:29:18 +0000 |
| commit | 065bd7d7039a10663fb06be7808e741c3f79e7f6 (patch) | |
| tree | 1879039cd14c4ddca7b3709aac1ea6b6cf23c1f7 /res/res_pjsip_pidf_digium_body_supplement.c | |
| parent | 9eae6c3f5bad40f3c23f34be9c8d33f67da49c72 (diff) | |
Improve XML sanitization in NOTIFYs, especially for presence subtypes and messages.
Embedded carriage return line feed combinations may appear in presence subtypes
and messages since they may be derived from user input in an instant messenger
client. As such, they need to be properly escaped so that XML parsers do not
vomit when the messages are received.
........
Merged revisions 413372 from http://svn.asterisk.org/svn/asterisk/branches/12
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@413381 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'res/res_pjsip_pidf_digium_body_supplement.c')
| -rw-r--r-- | res/res_pjsip_pidf_digium_body_supplement.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/res/res_pjsip_pidf_digium_body_supplement.c b/res/res_pjsip_pidf_digium_body_supplement.c index d1b2c6b56..22cd01be7 100644 --- a/res/res_pjsip_pidf_digium_body_supplement.c +++ b/res/res_pjsip_pidf_digium_body_supplement.c @@ -40,6 +40,7 @@ static int pidf_supplement_body(void *body, void *data) { struct ast_sip_exten_state_data *state_data = data; pj_xml_node *node; + char sanitized[256]; if (ast_strlen_zero(state_data->user_agent) || !strstr(state_data->user_agent, "digium")) { @@ -69,8 +70,8 @@ static int pidf_supplement_body(void *body, void *data) } if (!ast_strlen_zero(state_data->presence_message)) { - pj_strdup2(state_data->pool, &node->content, - state_data->presence_message); + ast_sip_sanitize_xml(state_data->presence_message, sanitized, sizeof(sanitized)); + pj_strdup2(state_data->pool, &node->content, sanitized); } ast_sip_presence_xml_create_attr( @@ -78,9 +79,9 @@ static int pidf_supplement_body(void *body, void *data) state_data->presence_state)); if (!ast_strlen_zero(state_data->presence_subtype)) { + ast_sip_sanitize_xml(state_data->presence_subtype, sanitized, sizeof(sanitized)); ast_sip_presence_xml_create_attr( - state_data->pool, node, "subtype", - state_data->presence_subtype); + state_data->pool, node, "subtype", sanitized); } return 0; |