[Cppcms-users] About escape filter

[redred77 <red...@gm...>]

1. I know that there is escape filter in cppcms already, but I found that
sometimes it's not enough.

According to rss validator, and rss spec, < > " & characters must be
escaped to hex.

validator : https://validator.w3.org/feed/
rss spec : http://www.rssboard.org/rss-profile#data-types-characterdata

A publisher SHOULD encode "&" and "<" in plain text using hexadecimal
character references. When encoding the ">" character, a publisher SHOULD use
the hexadecimal reference &#x3E;.

Using hex code is for compatibility reason, but many rss reader programs
don't recognize &quot; still. For example, SNS management site hootsuite.com's
internal rss reader takes some feed as invalid when &quot; character is in
title tag. Actually they don't need to update the rss reader because the
spec says it should be hex encoded.

So, I would like to suggest adding encode_hex like method. It is essential
when publishing rss feed from website.



2. Escaping (') apostrophe (single quote) character.

PHP's htmlspecialchars() function escapes apostrophe (single quote) when
such flag is set.
http://php.net/manual/en/function.htmlspecialchars.php

Also here are 5 item that are XML, HTML predefined entities.
https://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references#Predefined_entities_in_XML

I can think of some situations that user input may harm the website when
single quote is not escaped since web developers may use single quote at
double quote places. Especially, with javascript I prefer to use single
quote over double quote.

For security, I would like to suggest apostrophe must be escaped.



3. I copied from existing cppcms source code and made similar escape method
which escapes xml entities to hex and single quote (apostrophe)


std::string util::escape_hex(std::string const &s)
{
std::string content;
unsigned i, len = s.size();
content.reserve(len * 3 / 2);
for (i = 0; i<len; i++) {
char c = s[i];
switch (c){
case '<': content += "&#x3C;"; break;
case '>': content += "&#x3E;"; break;
case '&': content += "&#x26;"; break;
case '\"': content += "&#x22;"; break;
case '\'': content += "&#x27;"; break;
default: content += c;
}
}
return content;
}


It works as intended. Original source code is stable, and I just modified
some.



4. I want to discuss adding new escape method, and about apostrophe. And I
want to know if there's some issues that I didn't know.


Thanks.