Improve XML sanitization in NOTIFYs, especially for presence subtypes and messages.
[asterisk/asterisk.git] / res / res_pjsip / presence_xml.c
1 /*
2  * asterisk -- An open source telephony toolkit.
3  *
4  * Copyright (C) 2013, Digium, Inc.
5  *
6  * Kevin Harwell <kharwell@digium.com>
7  *
8  * See http://www.asterisk.org for more information about
9  * the Asterisk project. Please do not directly contact
10  * any of the maintainers of this project for assistance;
11  * the project provides a web site, mailing lists and IRC
12  * channels for your use.
13  *
14  * This program is free software, distributed under the terms of
15  * the GNU General Public License Version 2. See the LICENSE file
16  * at the top of the source tree.
17  */
18
19 /*** MODULEINFO
20         <depend>pjproject</depend>
21         <depend>res_pjsip</depend>
22         <depend>res_pjsip_pubsub</depend>
23         <depend>res_pjsip_exten_state</depend>
24         <support_level>core</support_level>
25  ***/
26
27 #include "asterisk.h"
28
29 #include <pjsip.h>
30 #include <pjsip_simple.h>
31 #include <pjlib.h>
32
33 #include "asterisk/module.h"
34 #include "asterisk/res_pjsip.h"
35 #include "asterisk/res_pjsip_pubsub.h"
36 #include "asterisk/res_pjsip_presence_xml.h"
37 #include "asterisk/res_pjsip_body_generator_types.h"
38
39 void ast_sip_sanitize_xml(const char *input, char *output, size_t len)
40 {
41         char *copy = ast_strdupa(input);
42         char *break_point;
43
44         output[0] = '\0';
45
46         while ((break_point = strpbrk(copy, "<>\"&'\n\r"))) {
47                 char to_escape = *break_point;
48
49                 *break_point = '\0';
50                 strncat(output, copy, len);
51
52                 switch (to_escape) {
53                 case '<':
54                         strncat(output, "&lt;", len);
55                         break;
56                 case '>':
57                         strncat(output, "&gt;", len);
58                         break;
59                 case '"':
60                         strncat(output, "&quot;", len);
61                         break;
62                 case '&':
63                         strncat(output, "&amp;", len);
64                         break;
65                 case '\'':
66                         strncat(output, "&apos;", len);
67                         break;
68                 case '\r':
69                         strncat(output, "&#13;", len);
70                         break;
71                 case '\n':
72                         strncat(output, "&#10;", len);
73                         break;
74                 };
75
76                 copy = break_point + 1;
77         }
78
79         /* Be sure to copy everything after the final bracket */
80         if (*copy) {
81                 strncat(output, copy, len);
82         }
83 }
84
85 void ast_sip_presence_exten_state_to_str(int state, char **statestring, char **pidfstate,
86                                char **pidfnote, enum ast_sip_pidf_state *local_state)
87 {
88         switch (state) {
89         case AST_EXTENSION_RINGING:
90                 *statestring = "early";
91                 *local_state = NOTIFY_INUSE;
92                 *pidfstate = "busy";
93                 *pidfnote = "Ringing";
94                 break;
95         case AST_EXTENSION_INUSE:
96                 *statestring = "confirmed";
97                 *local_state = NOTIFY_INUSE;
98                 *pidfstate = "busy";
99                 *pidfnote = "On the phone";
100                 break;
101         case AST_EXTENSION_BUSY:
102                 *statestring = "confirmed";
103                 *local_state = NOTIFY_CLOSED;
104                 *pidfstate = "busy";
105                 *pidfnote = "On the phone";
106                 break;
107         case AST_EXTENSION_UNAVAILABLE:
108                 *statestring = "terminated";
109                 *local_state = NOTIFY_CLOSED;
110                 *pidfstate = "away";
111                 *pidfnote = "Unavailable";
112                 break;
113         case AST_EXTENSION_ONHOLD:
114                 *statestring = "confirmed";
115                 *local_state = NOTIFY_CLOSED;
116                 *pidfstate = "busy";
117                 *pidfnote = "On hold";
118                 break;
119         case AST_EXTENSION_NOT_INUSE:
120         default:
121                 /* Default setting */
122                 *statestring = "terminated";
123                 *local_state = NOTIFY_OPEN;
124                 *pidfstate = "--";
125                 *pidfnote ="Ready";
126                 break;
127         }
128 }
129
130 pj_xml_attr *ast_sip_presence_xml_create_attr(pj_pool_t *pool,
131                 pj_xml_node *node, const char *name, const char *value)
132 {
133         pj_xml_attr *attr = PJ_POOL_ALLOC_T(pool, pj_xml_attr);
134
135         pj_strdup2(pool, &attr->name, name);
136         pj_strdup2(pool, &attr->value, value);
137
138         pj_xml_add_attr(node, attr);
139         return attr;
140 }
141
142 pj_xml_node *ast_sip_presence_xml_create_node(pj_pool_t *pool,
143                 pj_xml_node *parent, const char* name)
144 {
145         pj_xml_node *node = PJ_POOL_ALLOC_T(pool, pj_xml_node);
146
147         pj_list_init(&node->attr_head);
148         pj_list_init(&node->node_head);
149
150         pj_strdup2(pool, &node->name, name);
151
152         node->content.ptr = NULL;
153         node->content.slen = 0;
154
155         pj_xml_add_node(parent, node);
156         return node;
157 }
158
159 void ast_sip_presence_xml_find_node_attr(pj_pool_t* pool,
160                 pj_xml_node *parent, const char *node_name, const char *attr_name,
161                 pj_xml_node **node, pj_xml_attr **attr)
162 {
163         pj_str_t name;
164
165         if (!(*node = pj_xml_find_node(parent, pj_cstr(&name, node_name)))) {
166                 *node = ast_sip_presence_xml_create_node(pool, parent, node_name);
167         }
168
169         if (!(*attr = pj_xml_find_attr(*node, pj_cstr(&name, attr_name), NULL))) {
170                 *attr = ast_sip_presence_xml_create_attr(pool, *node, attr_name, "");
171         }
172 }