xref: /qemu/util/uri.c (revision b355f08a)
1 /**
2  * uri.c: set of generic URI related routines
3  *
4  * Reference: RFCs 3986, 2732 and 2373
5  *
6  * Copyright (C) 1998-2003 Daniel Veillard.  All Rights Reserved.
7  *
8  * Permission is hereby granted, free of charge, to any person obtaining a copy
9  * of this software and associated documentation files (the "Software"), to deal
10  * in the Software without restriction, including without limitation the rights
11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12  * copies of the Software, and to permit persons to whom the Software is
13  * furnished to do so, subject to the following conditions:
14  *
15  * The above copyright notice and this permission notice shall be included in
16  * all copies or substantial portions of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
21  * DANIEL VEILLARD BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
22  * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
23  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
24  *
25  * Except as contained in this notice, the name of Daniel Veillard shall not
26  * be used in advertising or otherwise to promote the sale, use or other
27  * dealings in this Software without prior written authorization from him.
28  *
29  * daniel@veillard.com
30  *
31  **
32  *
33  * Copyright (C) 2007, 2009-2010 Red Hat, Inc.
34  *
35  * This library is free software; you can redistribute it and/or
36  * modify it under the terms of the GNU Lesser General Public
37  * License as published by the Free Software Foundation; either
38  * version 2.1 of the License, or (at your option) any later version.
39  *
40  * This library is distributed in the hope that it will be useful,
41  * but WITHOUT ANY WARRANTY; without even the implied warranty of
42  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
43  * Lesser General Public License for more details.
44  *
45  * You should have received a copy of the GNU Lesser General Public
46  * License along with this library; if not, write to the Free Software
47  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
48  *
49  * Authors:
50  *    Richard W.M. Jones <rjones@redhat.com>
51  *
52  */
53 
54 #include "qemu/osdep.h"
55 #include "qemu/cutils.h"
56 
57 #include "qemu/uri.h"
58 
59 static void uri_clean(URI *uri);
60 
61 /*
62  * Old rule from 2396 used in legacy handling code
63  * alpha    = lowalpha | upalpha
64  */
65 #define IS_ALPHA(x) (IS_LOWALPHA(x) || IS_UPALPHA(x))
66 
67 /*
68  * lowalpha = "a" | "b" | "c" | "d" | "e" | "f" | "g" | "h" | "i" | "j" |
69  *            "k" | "l" | "m" | "n" | "o" | "p" | "q" | "r" | "s" | "t" |
70  *            "u" | "v" | "w" | "x" | "y" | "z"
71  */
72 
73 #define IS_LOWALPHA(x) (((x) >= 'a') && ((x) <= 'z'))
74 
75 /*
76  * upalpha = "A" | "B" | "C" | "D" | "E" | "F" | "G" | "H" | "I" | "J" |
77  *           "K" | "L" | "M" | "N" | "O" | "P" | "Q" | "R" | "S" | "T" |
78  *           "U" | "V" | "W" | "X" | "Y" | "Z"
79  */
80 #define IS_UPALPHA(x) (((x) >= 'A') && ((x) <= 'Z'))
81 
82 #ifdef IS_DIGIT
83 #undef IS_DIGIT
84 #endif
85 /*
86  * digit = "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9"
87  */
88 #define IS_DIGIT(x) (((x) >= '0') && ((x) <= '9'))
89 
90 /*
91  * alphanum = alpha | digit
92  */
93 
94 #define IS_ALPHANUM(x) (IS_ALPHA(x) || IS_DIGIT(x))
95 
96 /*
97  * mark = "-" | "_" | "." | "!" | "~" | "*" | "'" | "(" | ")"
98  */
99 
100 #define IS_MARK(x) (((x) == '-') || ((x) == '_') || ((x) == '.') ||            \
101     ((x) == '!') || ((x) == '~') || ((x) == '*') || ((x) == '\'') ||           \
102     ((x) == '(') || ((x) == ')'))
103 
104 /*
105  * unwise = "{" | "}" | "|" | "\" | "^" | "`"
106  */
107 
108 #define IS_UNWISE(p)                                                           \
109     (((*(p) == '{')) || ((*(p) == '}')) || ((*(p) == '|')) ||                  \
110      ((*(p) == '\\')) || ((*(p) == '^')) || ((*(p) == '[')) ||                 \
111      ((*(p) == ']')) || ((*(p) == '`')))
112 /*
113  * reserved = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "+" | "$" | "," |
114  *            "[" | "]"
115  */
116 
117 #define IS_RESERVED(x) (((x) == ';') || ((x) == '/') || ((x) == '?') ||        \
118     ((x) == ':') || ((x) == '@') || ((x) == '&') || ((x) == '=') ||            \
119     ((x) == '+') || ((x) == '$') || ((x) == ',') || ((x) == '[') ||            \
120     ((x) == ']'))
121 
122 /*
123  * unreserved = alphanum | mark
124  */
125 
126 #define IS_UNRESERVED(x) (IS_ALPHANUM(x) || IS_MARK(x))
127 
128 /*
129  * Skip to next pointer char, handle escaped sequences
130  */
131 
132 #define NEXT(p) ((*p == '%') ? p += 3 : p++)
133 
134 /*
135  * Productions from the spec.
136  *
137  *    authority     = server | reg_name
138  *    reg_name      = 1*( unreserved | escaped | "$" | "," |
139  *                        ";" | ":" | "@" | "&" | "=" | "+" )
140  *
141  * path          = [ abs_path | opaque_part ]
142  */
143 
144 /************************************************************************
145  *                                                                      *
146  *                         RFC 3986 parser                              *
147  *                                                                      *
148  ************************************************************************/
149 
150 #define ISA_DIGIT(p) ((*(p) >= '0') && (*(p) <= '9'))
151 #define ISA_ALPHA(p) (((*(p) >= 'a') && (*(p) <= 'z')) ||                      \
152                       ((*(p) >= 'A') && (*(p) <= 'Z')))
153 #define ISA_HEXDIG(p)                                                          \
154     (ISA_DIGIT(p) || ((*(p) >= 'a') && (*(p) <= 'f')) ||                       \
155      ((*(p) >= 'A') && (*(p) <= 'F')))
156 
157 /*
158  *    sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
159  *                     / "*" / "+" / "," / ";" / "="
160  */
161 #define ISA_SUB_DELIM(p)                                                       \
162     (((*(p) == '!')) || ((*(p) == '$')) || ((*(p) == '&')) ||                  \
163      ((*(p) == '(')) || ((*(p) == ')')) || ((*(p) == '*')) ||                  \
164      ((*(p) == '+')) || ((*(p) == ',')) || ((*(p) == ';')) ||                  \
165      ((*(p) == '=')) || ((*(p) == '\'')))
166 
167 /*
168  *    gen-delims    = ":" / "/" / "?" / "#" / "[" / "]" / "@"
169  */
170 #define ISA_GEN_DELIM(p)                                                       \
171     (((*(p) == ':')) || ((*(p) == '/')) || ((*(p) == '?')) ||                  \
172      ((*(p) == '#')) || ((*(p) == '[')) || ((*(p) == ']')) ||                  \
173      ((*(p) == '@')))
174 
175 /*
176  *    reserved      = gen-delims / sub-delims
177  */
178 #define ISA_RESERVED(p) (ISA_GEN_DELIM(p) || (ISA_SUB_DELIM(p)))
179 
180 /*
181  *    unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
182  */
183 #define ISA_UNRESERVED(p)                                                      \
184     ((ISA_ALPHA(p)) || (ISA_DIGIT(p)) || ((*(p) == '-')) ||                    \
185      ((*(p) == '.')) || ((*(p) == '_')) || ((*(p) == '~')))
186 
187 /*
188  *    pct-encoded   = "%" HEXDIG HEXDIG
189  */
190 #define ISA_PCT_ENCODED(p)                                                     \
191     ((*(p) == '%') && (ISA_HEXDIG(p + 1)) && (ISA_HEXDIG(p + 2)))
192 
193 /*
194  *    pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"
195  */
196 #define ISA_PCHAR(p)                                                           \
197     (ISA_UNRESERVED(p) || ISA_PCT_ENCODED(p) || ISA_SUB_DELIM(p) ||            \
198      ((*(p) == ':')) || ((*(p) == '@')))
199 
200 /**
201  * rfc3986_parse_scheme:
202  * @uri:  pointer to an URI structure
203  * @str:  pointer to the string to analyze
204  *
205  * Parse an URI scheme
206  *
207  * ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
208  *
209  * Returns 0 or the error code
210  */
211 static int rfc3986_parse_scheme(URI *uri, const char **str)
212 {
213     const char *cur;
214 
215     if (str == NULL) {
216         return -1;
217     }
218 
219     cur = *str;
220     if (!ISA_ALPHA(cur)) {
221         return 2;
222     }
223     cur++;
224     while (ISA_ALPHA(cur) || ISA_DIGIT(cur) || (*cur == '+') || (*cur == '-') ||
225            (*cur == '.')) {
226         cur++;
227     }
228     if (uri != NULL) {
229         g_free(uri->scheme);
230         uri->scheme = g_strndup(*str, cur - *str);
231     }
232     *str = cur;
233     return 0;
234 }
235 
236 /**
237  * rfc3986_parse_fragment:
238  * @uri:  pointer to an URI structure
239  * @str:  pointer to the string to analyze
240  *
241  * Parse the query part of an URI
242  *
243  * fragment      = *( pchar / "/" / "?" )
244  * NOTE: the strict syntax as defined by 3986 does not allow '[' and ']'
245  *       in the fragment identifier but this is used very broadly for
246  *       xpointer scheme selection, so we are allowing it here to not break
247  *       for example all the DocBook processing chains.
248  *
249  * Returns 0 or the error code
250  */
251 static int rfc3986_parse_fragment(URI *uri, const char **str)
252 {
253     const char *cur;
254 
255     if (str == NULL) {
256         return -1;
257     }
258 
259     cur = *str;
260 
261     while ((ISA_PCHAR(cur)) || (*cur == '/') || (*cur == '?') ||
262            (*cur == '[') || (*cur == ']') ||
263            ((uri != NULL) && (uri->cleanup & 1) && (IS_UNWISE(cur)))) {
264         NEXT(cur);
265     }
266     if (uri != NULL) {
267         g_free(uri->fragment);
268         if (uri->cleanup & 2) {
269             uri->fragment = g_strndup(*str, cur - *str);
270         } else {
271             uri->fragment = uri_string_unescape(*str, cur - *str, NULL);
272         }
273     }
274     *str = cur;
275     return 0;
276 }
277 
278 /**
279  * rfc3986_parse_query:
280  * @uri:  pointer to an URI structure
281  * @str:  pointer to the string to analyze
282  *
283  * Parse the query part of an URI
284  *
285  * query = *uric
286  *
287  * Returns 0 or the error code
288  */
289 static int rfc3986_parse_query(URI *uri, const char **str)
290 {
291     const char *cur;
292 
293     if (str == NULL) {
294         return -1;
295     }
296 
297     cur = *str;
298 
299     while ((ISA_PCHAR(cur)) || (*cur == '/') || (*cur == '?') ||
300            ((uri != NULL) && (uri->cleanup & 1) && (IS_UNWISE(cur)))) {
301         NEXT(cur);
302     }
303     if (uri != NULL) {
304         g_free(uri->query);
305         uri->query = g_strndup(*str, cur - *str);
306     }
307     *str = cur;
308     return 0;
309 }
310 
311 /**
312  * rfc3986_parse_port:
313  * @uri:  pointer to an URI structure
314  * @str:  the string to analyze
315  *
316  * Parse a port  part and fills in the appropriate fields
317  * of the @uri structure
318  *
319  * port          = *DIGIT
320  *
321  * Returns 0 or the error code
322  */
323 static int rfc3986_parse_port(URI *uri, const char **str)
324 {
325     const char *cur = *str;
326     int port = 0;
327 
328     if (ISA_DIGIT(cur)) {
329         while (ISA_DIGIT(cur)) {
330             port = port * 10 + (*cur - '0');
331             if (port > 65535) {
332                 return 1;
333             }
334             cur++;
335         }
336         if (uri) {
337             uri->port = port;
338         }
339         *str = cur;
340         return 0;
341     }
342     return 1;
343 }
344 
345 /**
346  * rfc3986_parse_user_info:
347  * @uri:  pointer to an URI structure
348  * @str:  the string to analyze
349  *
350  * Parse a user information part and fill in the appropriate fields
351  * of the @uri structure
352  *
353  * userinfo      = *( unreserved / pct-encoded / sub-delims / ":" )
354  *
355  * Returns 0 or the error code
356  */
357 static int rfc3986_parse_user_info(URI *uri, const char **str)
358 {
359     const char *cur;
360 
361     cur = *str;
362     while (ISA_UNRESERVED(cur) || ISA_PCT_ENCODED(cur) || ISA_SUB_DELIM(cur) ||
363            (*cur == ':')) {
364         NEXT(cur);
365     }
366     if (*cur == '@') {
367         if (uri != NULL) {
368             g_free(uri->user);
369             if (uri->cleanup & 2) {
370                 uri->user = g_strndup(*str, cur - *str);
371             } else {
372                 uri->user = uri_string_unescape(*str, cur - *str, NULL);
373             }
374         }
375         *str = cur;
376         return 0;
377     }
378     return 1;
379 }
380 
381 /**
382  * rfc3986_parse_dec_octet:
383  * @str:  the string to analyze
384  *
385  *    dec-octet     = DIGIT                 ; 0-9
386  *                  / %x31-39 DIGIT         ; 10-99
387  *                  / "1" 2DIGIT            ; 100-199
388  *                  / "2" %x30-34 DIGIT     ; 200-249
389  *                  / "25" %x30-35          ; 250-255
390  *
391  * Skip a dec-octet.
392  *
393  * Returns 0 if found and skipped, 1 otherwise
394  */
395 static int rfc3986_parse_dec_octet(const char **str)
396 {
397     const char *cur = *str;
398 
399     if (!(ISA_DIGIT(cur))) {
400         return 1;
401     }
402     if (!ISA_DIGIT(cur + 1)) {
403         cur++;
404     } else if ((*cur != '0') && (ISA_DIGIT(cur + 1)) && (!ISA_DIGIT(cur + 2))) {
405         cur += 2;
406     } else if ((*cur == '1') && (ISA_DIGIT(cur + 1)) && (ISA_DIGIT(cur + 2))) {
407         cur += 3;
408     } else if ((*cur == '2') && (*(cur + 1) >= '0') && (*(cur + 1) <= '4') &&
409              (ISA_DIGIT(cur + 2))) {
410         cur += 3;
411     } else if ((*cur == '2') && (*(cur + 1) == '5') && (*(cur + 2) >= '0') &&
412              (*(cur + 1) <= '5')) {
413         cur += 3;
414     } else {
415         return 1;
416     }
417     *str = cur;
418     return 0;
419 }
420 /**
421  * rfc3986_parse_host:
422  * @uri:  pointer to an URI structure
423  * @str:  the string to analyze
424  *
425  * Parse an host part and fills in the appropriate fields
426  * of the @uri structure
427  *
428  * host          = IP-literal / IPv4address / reg-name
429  * IP-literal    = "[" ( IPv6address / IPvFuture  ) "]"
430  * IPv4address   = dec-octet "." dec-octet "." dec-octet "." dec-octet
431  * reg-name      = *( unreserved / pct-encoded / sub-delims )
432  *
433  * Returns 0 or the error code
434  */
435 static int rfc3986_parse_host(URI *uri, const char **str)
436 {
437     const char *cur = *str;
438     const char *host;
439 
440     host = cur;
441     /*
442      * IPv6 and future addressing scheme are enclosed between brackets
443      */
444     if (*cur == '[') {
445         cur++;
446         while ((*cur != ']') && (*cur != 0)) {
447             cur++;
448         }
449         if (*cur != ']') {
450             return 1;
451         }
452         cur++;
453         goto found;
454     }
455     /*
456      * try to parse an IPv4
457      */
458     if (ISA_DIGIT(cur)) {
459         if (rfc3986_parse_dec_octet(&cur) != 0) {
460             goto not_ipv4;
461         }
462         if (*cur != '.') {
463             goto not_ipv4;
464         }
465         cur++;
466         if (rfc3986_parse_dec_octet(&cur) != 0) {
467             goto not_ipv4;
468         }
469         if (*cur != '.') {
470             goto not_ipv4;
471         }
472         if (rfc3986_parse_dec_octet(&cur) != 0) {
473             goto not_ipv4;
474         }
475         if (*cur != '.') {
476             goto not_ipv4;
477         }
478         if (rfc3986_parse_dec_octet(&cur) != 0) {
479             goto not_ipv4;
480         }
481         goto found;
482     not_ipv4:
483         cur = *str;
484     }
485     /*
486      * then this should be a hostname which can be empty
487      */
488     while (ISA_UNRESERVED(cur) || ISA_PCT_ENCODED(cur) || ISA_SUB_DELIM(cur)) {
489         NEXT(cur);
490     }
491 found:
492     if (uri != NULL) {
493         g_free(uri->authority);
494         uri->authority = NULL;
495         g_free(uri->server);
496         if (cur != host) {
497             if (uri->cleanup & 2) {
498                 uri->server = g_strndup(host, cur - host);
499             } else {
500                 uri->server = uri_string_unescape(host, cur - host, NULL);
501             }
502         } else {
503             uri->server = NULL;
504         }
505     }
506     *str = cur;
507     return 0;
508 }
509 
510 /**
511  * rfc3986_parse_authority:
512  * @uri:  pointer to an URI structure
513  * @str:  the string to analyze
514  *
515  * Parse an authority part and fills in the appropriate fields
516  * of the @uri structure
517  *
518  * authority     = [ userinfo "@" ] host [ ":" port ]
519  *
520  * Returns 0 or the error code
521  */
522 static int rfc3986_parse_authority(URI *uri, const char **str)
523 {
524     const char *cur;
525     int ret;
526 
527     cur = *str;
528     /*
529      * try to parse a userinfo and check for the trailing @
530      */
531     ret = rfc3986_parse_user_info(uri, &cur);
532     if ((ret != 0) || (*cur != '@')) {
533         cur = *str;
534     } else {
535         cur++;
536     }
537     ret = rfc3986_parse_host(uri, &cur);
538     if (ret != 0) {
539         return ret;
540     }
541     if (*cur == ':') {
542         cur++;
543         ret = rfc3986_parse_port(uri, &cur);
544         if (ret != 0) {
545             return ret;
546         }
547     }
548     *str = cur;
549     return 0;
550 }
551 
552 /**
553  * rfc3986_parse_segment:
554  * @str:  the string to analyze
555  * @forbid: an optional forbidden character
556  * @empty: allow an empty segment
557  *
558  * Parse a segment and fills in the appropriate fields
559  * of the @uri structure
560  *
561  * segment       = *pchar
562  * segment-nz    = 1*pchar
563  * segment-nz-nc = 1*( unreserved / pct-encoded / sub-delims / "@" )
564  *               ; non-zero-length segment without any colon ":"
565  *
566  * Returns 0 or the error code
567  */
568 static int rfc3986_parse_segment(const char **str, char forbid, int empty)
569 {
570     const char *cur;
571 
572     cur = *str;
573     if (!ISA_PCHAR(cur)) {
574         if (empty) {
575             return 0;
576         }
577         return 1;
578     }
579     while (ISA_PCHAR(cur) && (*cur != forbid)) {
580         NEXT(cur);
581     }
582     *str = cur;
583     return 0;
584 }
585 
586 /**
587  * rfc3986_parse_path_ab_empty:
588  * @uri:  pointer to an URI structure
589  * @str:  the string to analyze
590  *
591  * Parse an path absolute or empty and fills in the appropriate fields
592  * of the @uri structure
593  *
594  * path-abempty  = *( "/" segment )
595  *
596  * Returns 0 or the error code
597  */
598 static int rfc3986_parse_path_ab_empty(URI *uri, const char **str)
599 {
600     const char *cur;
601     int ret;
602 
603     cur = *str;
604 
605     while (*cur == '/') {
606         cur++;
607         ret = rfc3986_parse_segment(&cur, 0, 1);
608         if (ret != 0) {
609             return ret;
610         }
611     }
612     if (uri != NULL) {
613         g_free(uri->path);
614         if (*str != cur) {
615             if (uri->cleanup & 2) {
616                 uri->path = g_strndup(*str, cur - *str);
617             } else {
618                 uri->path = uri_string_unescape(*str, cur - *str, NULL);
619             }
620         } else {
621             uri->path = NULL;
622         }
623     }
624     *str = cur;
625     return 0;
626 }
627 
628 /**
629  * rfc3986_parse_path_absolute:
630  * @uri:  pointer to an URI structure
631  * @str:  the string to analyze
632  *
633  * Parse an path absolute and fills in the appropriate fields
634  * of the @uri structure
635  *
636  * path-absolute = "/" [ segment-nz *( "/" segment ) ]
637  *
638  * Returns 0 or the error code
639  */
640 static int rfc3986_parse_path_absolute(URI *uri, const char **str)
641 {
642     const char *cur;
643     int ret;
644 
645     cur = *str;
646 
647     if (*cur != '/') {
648         return 1;
649     }
650     cur++;
651     ret = rfc3986_parse_segment(&cur, 0, 0);
652     if (ret == 0) {
653         while (*cur == '/') {
654             cur++;
655             ret = rfc3986_parse_segment(&cur, 0, 1);
656             if (ret != 0) {
657                 return ret;
658             }
659         }
660     }
661     if (uri != NULL) {
662         g_free(uri->path);
663         if (cur != *str) {
664             if (uri->cleanup & 2) {
665                 uri->path = g_strndup(*str, cur - *str);
666             } else {
667                 uri->path = uri_string_unescape(*str, cur - *str, NULL);
668             }
669         } else {
670             uri->path = NULL;
671         }
672     }
673     *str = cur;
674     return 0;
675 }
676 
677 /**
678  * rfc3986_parse_path_rootless:
679  * @uri:  pointer to an URI structure
680  * @str:  the string to analyze
681  *
682  * Parse an path without root and fills in the appropriate fields
683  * of the @uri structure
684  *
685  * path-rootless = segment-nz *( "/" segment )
686  *
687  * Returns 0 or the error code
688  */
689 static int rfc3986_parse_path_rootless(URI *uri, const char **str)
690 {
691     const char *cur;
692     int ret;
693 
694     cur = *str;
695 
696     ret = rfc3986_parse_segment(&cur, 0, 0);
697     if (ret != 0) {
698         return ret;
699     }
700     while (*cur == '/') {
701         cur++;
702         ret = rfc3986_parse_segment(&cur, 0, 1);
703         if (ret != 0) {
704             return ret;
705         }
706     }
707     if (uri != NULL) {
708         g_free(uri->path);
709         if (cur != *str) {
710             if (uri->cleanup & 2) {
711                 uri->path = g_strndup(*str, cur - *str);
712             } else {
713                 uri->path = uri_string_unescape(*str, cur - *str, NULL);
714             }
715         } else {
716             uri->path = NULL;
717         }
718     }
719     *str = cur;
720     return 0;
721 }
722 
723 /**
724  * rfc3986_parse_path_no_scheme:
725  * @uri:  pointer to an URI structure
726  * @str:  the string to analyze
727  *
728  * Parse an path which is not a scheme and fills in the appropriate fields
729  * of the @uri structure
730  *
731  * path-noscheme = segment-nz-nc *( "/" segment )
732  *
733  * Returns 0 or the error code
734  */
735 static int rfc3986_parse_path_no_scheme(URI *uri, const char **str)
736 {
737     const char *cur;
738     int ret;
739 
740     cur = *str;
741 
742     ret = rfc3986_parse_segment(&cur, ':', 0);
743     if (ret != 0) {
744         return ret;
745     }
746     while (*cur == '/') {
747         cur++;
748         ret = rfc3986_parse_segment(&cur, 0, 1);
749         if (ret != 0) {
750             return ret;
751         }
752     }
753     if (uri != NULL) {
754         g_free(uri->path);
755         if (cur != *str) {
756             if (uri->cleanup & 2) {
757                 uri->path = g_strndup(*str, cur - *str);
758             } else {
759                 uri->path = uri_string_unescape(*str, cur - *str, NULL);
760             }
761         } else {
762             uri->path = NULL;
763         }
764     }
765     *str = cur;
766     return 0;
767 }
768 
769 /**
770  * rfc3986_parse_hier_part:
771  * @uri:  pointer to an URI structure
772  * @str:  the string to analyze
773  *
774  * Parse an hierarchical part and fills in the appropriate fields
775  * of the @uri structure
776  *
777  * hier-part     = "//" authority path-abempty
778  *                / path-absolute
779  *                / path-rootless
780  *                / path-empty
781  *
782  * Returns 0 or the error code
783  */
784 static int rfc3986_parse_hier_part(URI *uri, const char **str)
785 {
786     const char *cur;
787     int ret;
788 
789     cur = *str;
790 
791     if ((*cur == '/') && (*(cur + 1) == '/')) {
792         cur += 2;
793         ret = rfc3986_parse_authority(uri, &cur);
794         if (ret != 0) {
795             return ret;
796         }
797         ret = rfc3986_parse_path_ab_empty(uri, &cur);
798         if (ret != 0) {
799             return ret;
800         }
801         *str = cur;
802         return 0;
803     } else if (*cur == '/') {
804         ret = rfc3986_parse_path_absolute(uri, &cur);
805         if (ret != 0) {
806             return ret;
807         }
808     } else if (ISA_PCHAR(cur)) {
809         ret = rfc3986_parse_path_rootless(uri, &cur);
810         if (ret != 0) {
811             return ret;
812         }
813     } else {
814         /* path-empty is effectively empty */
815         if (uri != NULL) {
816             g_free(uri->path);
817             uri->path = NULL;
818         }
819     }
820     *str = cur;
821     return 0;
822 }
823 
824 /**
825  * rfc3986_parse_relative_ref:
826  * @uri:  pointer to an URI structure
827  * @str:  the string to analyze
828  *
829  * Parse an URI string and fills in the appropriate fields
830  * of the @uri structure
831  *
832  * relative-ref  = relative-part [ "?" query ] [ "#" fragment ]
833  * relative-part = "//" authority path-abempty
834  *               / path-absolute
835  *               / path-noscheme
836  *               / path-empty
837  *
838  * Returns 0 or the error code
839  */
840 static int rfc3986_parse_relative_ref(URI *uri, const char *str)
841 {
842     int ret;
843 
844     if ((*str == '/') && (*(str + 1) == '/')) {
845         str += 2;
846         ret = rfc3986_parse_authority(uri, &str);
847         if (ret != 0) {
848             return ret;
849         }
850         ret = rfc3986_parse_path_ab_empty(uri, &str);
851         if (ret != 0) {
852             return ret;
853         }
854     } else if (*str == '/') {
855         ret = rfc3986_parse_path_absolute(uri, &str);
856         if (ret != 0) {
857             return ret;
858         }
859     } else if (ISA_PCHAR(str)) {
860         ret = rfc3986_parse_path_no_scheme(uri, &str);
861         if (ret != 0) {
862             return ret;
863         }
864     } else {
865         /* path-empty is effectively empty */
866         if (uri != NULL) {
867             g_free(uri->path);
868             uri->path = NULL;
869         }
870     }
871 
872     if (*str == '?') {
873         str++;
874         ret = rfc3986_parse_query(uri, &str);
875         if (ret != 0) {
876             return ret;
877         }
878     }
879     if (*str == '#') {
880         str++;
881         ret = rfc3986_parse_fragment(uri, &str);
882         if (ret != 0) {
883             return ret;
884         }
885     }
886     if (*str != 0) {
887         uri_clean(uri);
888         return 1;
889     }
890     return 0;
891 }
892 
893 /**
894  * rfc3986_parse:
895  * @uri:  pointer to an URI structure
896  * @str:  the string to analyze
897  *
898  * Parse an URI string and fills in the appropriate fields
899  * of the @uri structure
900  *
901  * scheme ":" hier-part [ "?" query ] [ "#" fragment ]
902  *
903  * Returns 0 or the error code
904  */
905 static int rfc3986_parse(URI *uri, const char *str)
906 {
907     int ret;
908 
909     ret = rfc3986_parse_scheme(uri, &str);
910     if (ret != 0) {
911         return ret;
912     }
913     if (*str != ':') {
914         return 1;
915     }
916     str++;
917     ret = rfc3986_parse_hier_part(uri, &str);
918     if (ret != 0) {
919         return ret;
920     }
921     if (*str == '?') {
922         str++;
923         ret = rfc3986_parse_query(uri, &str);
924         if (ret != 0) {
925             return ret;
926         }
927     }
928     if (*str == '#') {
929         str++;
930         ret = rfc3986_parse_fragment(uri, &str);
931         if (ret != 0) {
932             return ret;
933         }
934     }
935     if (*str != 0) {
936         uri_clean(uri);
937         return 1;
938     }
939     return 0;
940 }
941 
942 /**
943  * rfc3986_parse_uri_reference:
944  * @uri:  pointer to an URI structure
945  * @str:  the string to analyze
946  *
947  * Parse an URI reference string and fills in the appropriate fields
948  * of the @uri structure
949  *
950  * URI-reference = URI / relative-ref
951  *
952  * Returns 0 or the error code
953  */
954 static int rfc3986_parse_uri_reference(URI *uri, const char *str)
955 {
956     int ret;
957 
958     if (str == NULL) {
959         return -1;
960     }
961     uri_clean(uri);
962 
963     /*
964      * Try first to parse absolute refs, then fallback to relative if
965      * it fails.
966      */
967     ret = rfc3986_parse(uri, str);
968     if (ret != 0) {
969         uri_clean(uri);
970         ret = rfc3986_parse_relative_ref(uri, str);
971         if (ret != 0) {
972             uri_clean(uri);
973             return ret;
974         }
975     }
976     return 0;
977 }
978 
979 /**
980  * uri_parse:
981  * @str:  the URI string to analyze
982  *
983  * Parse an URI based on RFC 3986
984  *
985  * URI-reference = [ absoluteURI | relativeURI ] [ "#" fragment ]
986  *
987  * Returns a newly built URI or NULL in case of error
988  */
989 URI *uri_parse(const char *str)
990 {
991     URI *uri;
992     int ret;
993 
994     if (str == NULL) {
995         return NULL;
996     }
997     uri = uri_new();
998     ret = rfc3986_parse_uri_reference(uri, str);
999     if (ret) {
1000         uri_free(uri);
1001         return NULL;
1002     }
1003     return uri;
1004 }
1005 
1006 /**
1007  * uri_parse_into:
1008  * @uri:  pointer to an URI structure
1009  * @str:  the string to analyze
1010  *
1011  * Parse an URI reference string based on RFC 3986 and fills in the
1012  * appropriate fields of the @uri structure
1013  *
1014  * URI-reference = URI / relative-ref
1015  *
1016  * Returns 0 or the error code
1017  */
1018 int uri_parse_into(URI *uri, const char *str)
1019 {
1020     return rfc3986_parse_uri_reference(uri, str);
1021 }
1022 
1023 /**
1024  * uri_parse_raw:
1025  * @str:  the URI string to analyze
1026  * @raw:  if 1 unescaping of URI pieces are disabled
1027  *
1028  * Parse an URI but allows to keep intact the original fragments.
1029  *
1030  * URI-reference = URI / relative-ref
1031  *
1032  * Returns a newly built URI or NULL in case of error
1033  */
1034 URI *uri_parse_raw(const char *str, int raw)
1035 {
1036     URI *uri;
1037     int ret;
1038 
1039     if (str == NULL) {
1040         return NULL;
1041     }
1042     uri = uri_new();
1043     if (raw) {
1044         uri->cleanup |= 2;
1045     }
1046     ret = uri_parse_into(uri, str);
1047     if (ret) {
1048         uri_free(uri);
1049         return NULL;
1050     }
1051     return uri;
1052 }
1053 
1054 /************************************************************************
1055  *                                                                      *
1056  *                    Generic URI structure functions                   *
1057  *                                                                      *
1058  ************************************************************************/
1059 
1060 /**
1061  * uri_new:
1062  *
1063  * Simply creates an empty URI
1064  *
1065  * Returns the new structure or NULL in case of error
1066  */
1067 URI *uri_new(void)
1068 {
1069     return g_new0(URI, 1);
1070 }
1071 
1072 /**
1073  * realloc2n:
1074  *
1075  * Function to handle properly a reallocation when saving an URI
1076  * Also imposes some limit on the length of an URI string output
1077  */
1078 static char *realloc2n(char *ret, int *max)
1079 {
1080     char *temp;
1081     int tmp;
1082 
1083     tmp = *max * 2;
1084     temp = g_realloc(ret, (tmp + 1));
1085     *max = tmp;
1086     return temp;
1087 }
1088 
1089 /**
1090  * uri_to_string:
1091  * @uri:  pointer to an URI
1092  *
1093  * Save the URI as an escaped string
1094  *
1095  * Returns a new string (to be deallocated by caller)
1096  */
1097 char *uri_to_string(URI *uri)
1098 {
1099     char *ret = NULL;
1100     char *temp;
1101     const char *p;
1102     int len;
1103     int max;
1104 
1105     if (uri == NULL) {
1106         return NULL;
1107     }
1108 
1109     max = 80;
1110     ret = g_malloc(max + 1);
1111     len = 0;
1112 
1113     if (uri->scheme != NULL) {
1114         p = uri->scheme;
1115         while (*p != 0) {
1116             if (len >= max) {
1117                 temp = realloc2n(ret, &max);
1118                 ret = temp;
1119             }
1120             ret[len++] = *p++;
1121         }
1122         if (len >= max) {
1123             temp = realloc2n(ret, &max);
1124             ret = temp;
1125         }
1126         ret[len++] = ':';
1127     }
1128     if (uri->opaque != NULL) {
1129         p = uri->opaque;
1130         while (*p != 0) {
1131             if (len + 3 >= max) {
1132                 temp = realloc2n(ret, &max);
1133                 ret = temp;
1134             }
1135             if (IS_RESERVED(*(p)) || IS_UNRESERVED(*(p))) {
1136                 ret[len++] = *p++;
1137             } else {
1138                 int val = *(unsigned char *)p++;
1139                 int hi = val / 0x10, lo = val % 0x10;
1140                 ret[len++] = '%';
1141                 ret[len++] = hi + (hi > 9 ? 'A' - 10 : '0');
1142                 ret[len++] = lo + (lo > 9 ? 'A' - 10 : '0');
1143             }
1144         }
1145     } else {
1146         if (uri->server != NULL) {
1147             if (len + 3 >= max) {
1148                 temp = realloc2n(ret, &max);
1149                 ret = temp;
1150             }
1151             ret[len++] = '/';
1152             ret[len++] = '/';
1153             if (uri->user != NULL) {
1154                 p = uri->user;
1155                 while (*p != 0) {
1156                     if (len + 3 >= max) {
1157                         temp = realloc2n(ret, &max);
1158                         ret = temp;
1159                     }
1160                     if ((IS_UNRESERVED(*(p))) || ((*(p) == ';')) ||
1161                         ((*(p) == ':')) || ((*(p) == '&')) || ((*(p) == '=')) ||
1162                         ((*(p) == '+')) || ((*(p) == '$')) || ((*(p) == ','))) {
1163                         ret[len++] = *p++;
1164                     } else {
1165                         int val = *(unsigned char *)p++;
1166                         int hi = val / 0x10, lo = val % 0x10;
1167                         ret[len++] = '%';
1168                         ret[len++] = hi + (hi > 9 ? 'A' - 10 : '0');
1169                         ret[len++] = lo + (lo > 9 ? 'A' - 10 : '0');
1170                     }
1171                 }
1172                 if (len + 3 >= max) {
1173                     temp = realloc2n(ret, &max);
1174                     ret = temp;
1175                 }
1176                 ret[len++] = '@';
1177             }
1178             p = uri->server;
1179             while (*p != 0) {
1180                 if (len >= max) {
1181                     temp = realloc2n(ret, &max);
1182                     ret = temp;
1183                 }
1184                 ret[len++] = *p++;
1185             }
1186             if (uri->port > 0) {
1187                 if (len + 10 >= max) {
1188                     temp = realloc2n(ret, &max);
1189                     ret = temp;
1190                 }
1191                 len += snprintf(&ret[len], max - len, ":%d", uri->port);
1192             }
1193         } else if (uri->authority != NULL) {
1194             if (len + 3 >= max) {
1195                 temp = realloc2n(ret, &max);
1196                 ret = temp;
1197             }
1198             ret[len++] = '/';
1199             ret[len++] = '/';
1200             p = uri->authority;
1201             while (*p != 0) {
1202                 if (len + 3 >= max) {
1203                     temp = realloc2n(ret, &max);
1204                     ret = temp;
1205                 }
1206                 if ((IS_UNRESERVED(*(p))) || ((*(p) == '$')) ||
1207                     ((*(p) == ',')) || ((*(p) == ';')) || ((*(p) == ':')) ||
1208                     ((*(p) == '@')) || ((*(p) == '&')) || ((*(p) == '=')) ||
1209                     ((*(p) == '+'))) {
1210                     ret[len++] = *p++;
1211                 } else {
1212                     int val = *(unsigned char *)p++;
1213                     int hi = val / 0x10, lo = val % 0x10;
1214                     ret[len++] = '%';
1215                     ret[len++] = hi + (hi > 9 ? 'A' - 10 : '0');
1216                     ret[len++] = lo + (lo > 9 ? 'A' - 10 : '0');
1217                 }
1218             }
1219         } else if (uri->scheme != NULL) {
1220             if (len + 3 >= max) {
1221                 temp = realloc2n(ret, &max);
1222                 ret = temp;
1223             }
1224             ret[len++] = '/';
1225             ret[len++] = '/';
1226         }
1227         if (uri->path != NULL) {
1228             p = uri->path;
1229             /*
1230              * the colon in file:///d: should not be escaped or
1231              * Windows accesses fail later.
1232              */
1233             if ((uri->scheme != NULL) && (p[0] == '/') &&
1234                 (((p[1] >= 'a') && (p[1] <= 'z')) ||
1235                  ((p[1] >= 'A') && (p[1] <= 'Z'))) &&
1236                 (p[2] == ':') && (!strcmp(uri->scheme, "file"))) {
1237                 if (len + 3 >= max) {
1238                     temp = realloc2n(ret, &max);
1239                     ret = temp;
1240                 }
1241                 ret[len++] = *p++;
1242                 ret[len++] = *p++;
1243                 ret[len++] = *p++;
1244             }
1245             while (*p != 0) {
1246                 if (len + 3 >= max) {
1247                     temp = realloc2n(ret, &max);
1248                     ret = temp;
1249                 }
1250                 if ((IS_UNRESERVED(*(p))) || ((*(p) == '/')) ||
1251                     ((*(p) == ';')) || ((*(p) == '@')) || ((*(p) == '&')) ||
1252                     ((*(p) == '=')) || ((*(p) == '+')) || ((*(p) == '$')) ||
1253                     ((*(p) == ','))) {
1254                     ret[len++] = *p++;
1255                 } else {
1256                     int val = *(unsigned char *)p++;
1257                     int hi = val / 0x10, lo = val % 0x10;
1258                     ret[len++] = '%';
1259                     ret[len++] = hi + (hi > 9 ? 'A' - 10 : '0');
1260                     ret[len++] = lo + (lo > 9 ? 'A' - 10 : '0');
1261                 }
1262             }
1263         }
1264         if (uri->query != NULL) {
1265             if (len + 1 >= max) {
1266                 temp = realloc2n(ret, &max);
1267                 ret = temp;
1268             }
1269             ret[len++] = '?';
1270             p = uri->query;
1271             while (*p != 0) {
1272                 if (len + 1 >= max) {
1273                     temp = realloc2n(ret, &max);
1274                     ret = temp;
1275                 }
1276                 ret[len++] = *p++;
1277             }
1278         }
1279     }
1280     if (uri->fragment != NULL) {
1281         if (len + 3 >= max) {
1282             temp = realloc2n(ret, &max);
1283             ret = temp;
1284         }
1285         ret[len++] = '#';
1286         p = uri->fragment;
1287         while (*p != 0) {
1288             if (len + 3 >= max) {
1289                 temp = realloc2n(ret, &max);
1290                 ret = temp;
1291             }
1292             if ((IS_UNRESERVED(*(p))) || (IS_RESERVED(*(p)))) {
1293                 ret[len++] = *p++;
1294             } else {
1295                 int val = *(unsigned char *)p++;
1296                 int hi = val / 0x10, lo = val % 0x10;
1297                 ret[len++] = '%';
1298                 ret[len++] = hi + (hi > 9 ? 'A' - 10 : '0');
1299                 ret[len++] = lo + (lo > 9 ? 'A' - 10 : '0');
1300             }
1301         }
1302     }
1303     if (len >= max) {
1304         temp = realloc2n(ret, &max);
1305         ret = temp;
1306     }
1307     ret[len] = 0;
1308     return ret;
1309 }
1310 
1311 /**
1312  * uri_clean:
1313  * @uri:  pointer to an URI
1314  *
1315  * Make sure the URI struct is free of content
1316  */
1317 static void uri_clean(URI *uri)
1318 {
1319     if (uri == NULL) {
1320         return;
1321     }
1322 
1323     g_free(uri->scheme);
1324     uri->scheme = NULL;
1325     g_free(uri->server);
1326     uri->server = NULL;
1327     g_free(uri->user);
1328     uri->user = NULL;
1329     g_free(uri->path);
1330     uri->path = NULL;
1331     g_free(uri->fragment);
1332     uri->fragment = NULL;
1333     g_free(uri->opaque);
1334     uri->opaque = NULL;
1335     g_free(uri->authority);
1336     uri->authority = NULL;
1337     g_free(uri->query);
1338     uri->query = NULL;
1339 }
1340 
1341 /**
1342  * uri_free:
1343  * @uri:  pointer to an URI, NULL is ignored
1344  *
1345  * Free up the URI struct
1346  */
1347 void uri_free(URI *uri)
1348 {
1349     uri_clean(uri);
1350     g_free(uri);
1351 }
1352 
1353 /************************************************************************
1354  *                                                                      *
1355  *                           Helper functions                           *
1356  *                                                                      *
1357  ************************************************************************/
1358 
1359 /**
1360  * normalize_uri_path:
1361  * @path:  pointer to the path string
1362  *
1363  * Applies the 5 normalization steps to a path string--that is, RFC 2396
1364  * Section 5.2, steps 6.c through 6.g.
1365  *
1366  * Normalization occurs directly on the string, no new allocation is done
1367  *
1368  * Returns 0 or an error code
1369  */
1370 static int normalize_uri_path(char *path)
1371 {
1372     char *cur, *out;
1373 
1374     if (path == NULL) {
1375         return -1;
1376     }
1377 
1378     /* Skip all initial "/" chars.  We want to get to the beginning of the
1379      * first non-empty segment.
1380      */
1381     cur = path;
1382     while (cur[0] == '/') {
1383         ++cur;
1384     }
1385     if (cur[0] == '\0') {
1386         return 0;
1387     }
1388 
1389     /* Keep everything we've seen so far.  */
1390     out = cur;
1391 
1392     /*
1393      * Analyze each segment in sequence for cases (c) and (d).
1394      */
1395     while (cur[0] != '\0') {
1396         /*
1397          * c) All occurrences of "./", where "." is a complete path segment,
1398          *    are removed from the buffer string.
1399          */
1400         if ((cur[0] == '.') && (cur[1] == '/')) {
1401             cur += 2;
1402             /* '//' normalization should be done at this point too */
1403             while (cur[0] == '/') {
1404                 cur++;
1405             }
1406             continue;
1407         }
1408 
1409         /*
1410          * d) If the buffer string ends with "." as a complete path segment,
1411          *    that "." is removed.
1412          */
1413         if ((cur[0] == '.') && (cur[1] == '\0')) {
1414             break;
1415         }
1416 
1417         /* Otherwise keep the segment.  */
1418         while (cur[0] != '/') {
1419             if (cur[0] == '\0') {
1420                 goto done_cd;
1421             }
1422             (out++)[0] = (cur++)[0];
1423         }
1424         /* nomalize // */
1425         while ((cur[0] == '/') && (cur[1] == '/')) {
1426             cur++;
1427         }
1428 
1429         (out++)[0] = (cur++)[0];
1430     }
1431 done_cd:
1432     out[0] = '\0';
1433 
1434     /* Reset to the beginning of the first segment for the next sequence.  */
1435     cur = path;
1436     while (cur[0] == '/') {
1437         ++cur;
1438     }
1439     if (cur[0] == '\0') {
1440         return 0;
1441     }
1442 
1443     /*
1444      * Analyze each segment in sequence for cases (e) and (f).
1445      *
1446      * e) All occurrences of "<segment>/../", where <segment> is a
1447      *    complete path segment not equal to "..", are removed from the
1448      *    buffer string.  Removal of these path segments is performed
1449      *    iteratively, removing the leftmost matching pattern on each
1450      *    iteration, until no matching pattern remains.
1451      *
1452      * f) If the buffer string ends with "<segment>/..", where <segment>
1453      *    is a complete path segment not equal to "..", that
1454      *    "<segment>/.." is removed.
1455      *
1456      * To satisfy the "iterative" clause in (e), we need to collapse the
1457      * string every time we find something that needs to be removed.  Thus,
1458      * we don't need to keep two pointers into the string: we only need a
1459      * "current position" pointer.
1460      */
1461     while (1) {
1462         char *segp, *tmp;
1463 
1464         /* At the beginning of each iteration of this loop, "cur" points to
1465          * the first character of the segment we want to examine.
1466          */
1467 
1468         /* Find the end of the current segment.  */
1469         segp = cur;
1470         while ((segp[0] != '/') && (segp[0] != '\0')) {
1471             ++segp;
1472         }
1473 
1474         /* If this is the last segment, we're done (we need at least two
1475          * segments to meet the criteria for the (e) and (f) cases).
1476          */
1477         if (segp[0] == '\0') {
1478             break;
1479         }
1480 
1481         /* If the first segment is "..", or if the next segment _isn't_ "..",
1482          * keep this segment and try the next one.
1483          */
1484         ++segp;
1485         if (((cur[0] == '.') && (cur[1] == '.') && (segp == cur + 3)) ||
1486             ((segp[0] != '.') || (segp[1] != '.') ||
1487              ((segp[2] != '/') && (segp[2] != '\0')))) {
1488             cur = segp;
1489             continue;
1490         }
1491 
1492         /* If we get here, remove this segment and the next one and back up
1493          * to the previous segment (if there is one), to implement the
1494          * "iteratively" clause.  It's pretty much impossible to back up
1495          * while maintaining two pointers into the buffer, so just compact
1496          * the whole buffer now.
1497          */
1498 
1499         /* If this is the end of the buffer, we're done.  */
1500         if (segp[2] == '\0') {
1501             cur[0] = '\0';
1502             break;
1503         }
1504         /* Valgrind complained, strcpy(cur, segp + 3); */
1505         /* string will overlap, do not use strcpy */
1506         tmp = cur;
1507         segp += 3;
1508         while ((*tmp++ = *segp++) != 0) {
1509             /* No further work */
1510         }
1511 
1512         /* If there are no previous segments, then keep going from here.  */
1513         segp = cur;
1514         while ((segp > path) && ((--segp)[0] == '/')) {
1515             /* No further work */
1516         }
1517         if (segp == path) {
1518             continue;
1519         }
1520 
1521         /* "segp" is pointing to the end of a previous segment; find it's
1522          * start.  We need to back up to the previous segment and start
1523          * over with that to handle things like "foo/bar/../..".  If we
1524          * don't do this, then on the first pass we'll remove the "bar/..",
1525          * but be pointing at the second ".." so we won't realize we can also
1526          * remove the "foo/..".
1527          */
1528         cur = segp;
1529         while ((cur > path) && (cur[-1] != '/')) {
1530             --cur;
1531         }
1532     }
1533     out[0] = '\0';
1534 
1535     /*
1536      * g) If the resulting buffer string still begins with one or more
1537      *    complete path segments of "..", then the reference is
1538      *    considered to be in error. Implementations may handle this
1539      *    error by retaining these components in the resolved path (i.e.,
1540      *    treating them as part of the final URI), by removing them from
1541      *    the resolved path (i.e., discarding relative levels above the
1542      *    root), or by avoiding traversal of the reference.
1543      *
1544      * We discard them from the final path.
1545      */
1546     if (path[0] == '/') {
1547         cur = path;
1548         while ((cur[0] == '/') && (cur[1] == '.') && (cur[2] == '.') &&
1549                ((cur[3] == '/') || (cur[3] == '\0'))) {
1550             cur += 3;
1551         }
1552 
1553         if (cur != path) {
1554             out = path;
1555             while (cur[0] != '\0') {
1556                 (out++)[0] = (cur++)[0];
1557             }
1558             out[0] = 0;
1559         }
1560     }
1561 
1562     return 0;
1563 }
1564 
1565 static int is_hex(char c)
1566 {
1567     if (((c >= '0') && (c <= '9')) || ((c >= 'a') && (c <= 'f')) ||
1568         ((c >= 'A') && (c <= 'F'))) {
1569         return 1;
1570     }
1571     return 0;
1572 }
1573 
1574 /**
1575  * uri_string_unescape:
1576  * @str:  the string to unescape
1577  * @len:   the length in bytes to unescape (or <= 0 to indicate full string)
1578  * @target:  optional destination buffer
1579  *
1580  * Unescaping routine, but does not check that the string is an URI. The
1581  * output is a direct unsigned char translation of %XX values (no encoding)
1582  * Note that the length of the result can only be smaller or same size as
1583  * the input string.
1584  *
1585  * Returns a copy of the string, but unescaped, will return NULL only in case
1586  * of error
1587  */
1588 char *uri_string_unescape(const char *str, int len, char *target)
1589 {
1590     char *ret, *out;
1591     const char *in;
1592 
1593     if (str == NULL) {
1594         return NULL;
1595     }
1596     if (len <= 0) {
1597         len = strlen(str);
1598     }
1599     if (len < 0) {
1600         return NULL;
1601     }
1602 
1603     if (target == NULL) {
1604         ret = g_malloc(len + 1);
1605     } else {
1606         ret = target;
1607     }
1608     in = str;
1609     out = ret;
1610     while (len > 0) {
1611         if ((len > 2) && (*in == '%') && (is_hex(in[1])) && (is_hex(in[2]))) {
1612             in++;
1613             if ((*in >= '0') && (*in <= '9')) {
1614                 *out = (*in - '0');
1615             } else if ((*in >= 'a') && (*in <= 'f')) {
1616                 *out = (*in - 'a') + 10;
1617             } else if ((*in >= 'A') && (*in <= 'F')) {
1618                 *out = (*in - 'A') + 10;
1619             }
1620             in++;
1621             if ((*in >= '0') && (*in <= '9')) {
1622                 *out = *out * 16 + (*in - '0');
1623             } else if ((*in >= 'a') && (*in <= 'f')) {
1624                 *out = *out * 16 + (*in - 'a') + 10;
1625             } else if ((*in >= 'A') && (*in <= 'F')) {
1626                 *out = *out * 16 + (*in - 'A') + 10;
1627             }
1628             in++;
1629             len -= 3;
1630             out++;
1631         } else {
1632             *out++ = *in++;
1633             len--;
1634         }
1635     }
1636     *out = 0;
1637     return ret;
1638 }
1639 
1640 /**
1641  * uri_string_escape:
1642  * @str:  string to escape
1643  * @list: exception list string of chars not to escape
1644  *
1645  * This routine escapes a string to hex, ignoring reserved characters (a-z)
1646  * and the characters in the exception list.
1647  *
1648  * Returns a new escaped string or NULL in case of error.
1649  */
1650 char *uri_string_escape(const char *str, const char *list)
1651 {
1652     char *ret, ch;
1653     char *temp;
1654     const char *in;
1655     int len, out;
1656 
1657     if (str == NULL) {
1658         return NULL;
1659     }
1660     if (str[0] == 0) {
1661         return g_strdup(str);
1662     }
1663     len = strlen(str);
1664     if (!(len > 0)) {
1665         return NULL;
1666     }
1667 
1668     len += 20;
1669     ret = g_malloc(len);
1670     in = str;
1671     out = 0;
1672     while (*in != 0) {
1673         if (len - out <= 3) {
1674             temp = realloc2n(ret, &len);
1675             ret = temp;
1676         }
1677 
1678         ch = *in;
1679 
1680         if ((ch != '@') && (!IS_UNRESERVED(ch)) && (!strchr(list, ch))) {
1681             unsigned char val;
1682             ret[out++] = '%';
1683             val = ch >> 4;
1684             if (val <= 9) {
1685                 ret[out++] = '0' + val;
1686             } else {
1687                 ret[out++] = 'A' + val - 0xA;
1688             }
1689             val = ch & 0xF;
1690             if (val <= 9) {
1691                 ret[out++] = '0' + val;
1692             } else {
1693                 ret[out++] = 'A' + val - 0xA;
1694             }
1695             in++;
1696         } else {
1697             ret[out++] = *in++;
1698         }
1699     }
1700     ret[out] = 0;
1701     return ret;
1702 }
1703 
1704 /************************************************************************
1705  *                                                                      *
1706  *                           Public functions                           *
1707  *                                                                      *
1708  ************************************************************************/
1709 
1710 /**
1711  * uri_resolve:
1712  * @URI:  the URI instance found in the document
1713  * @base:  the base value
1714  *
1715  * Computes he final URI of the reference done by checking that
1716  * the given URI is valid, and building the final URI using the
1717  * base URI. This is processed according to section 5.2 of the
1718  * RFC 2396
1719  *
1720  * 5.2. Resolving Relative References to Absolute Form
1721  *
1722  * Returns a new URI string (to be freed by the caller) or NULL in case
1723  *         of error.
1724  */
1725 char *uri_resolve(const char *uri, const char *base)
1726 {
1727     char *val = NULL;
1728     int ret, len, indx, cur, out;
1729     URI *ref = NULL;
1730     URI *bas = NULL;
1731     URI *res = NULL;
1732 
1733     /*
1734      * 1) The URI reference is parsed into the potential four components and
1735      *    fragment identifier, as described in Section 4.3.
1736      *
1737      *    NOTE that a completely empty URI is treated by modern browsers
1738      *    as a reference to "." rather than as a synonym for the current
1739      *    URI.  Should we do that here?
1740      */
1741     if (uri == NULL) {
1742         ret = -1;
1743     } else {
1744         if (*uri) {
1745             ref = uri_new();
1746             ret = uri_parse_into(ref, uri);
1747         } else {
1748             ret = 0;
1749         }
1750     }
1751     if (ret != 0) {
1752         goto done;
1753     }
1754     if ((ref != NULL) && (ref->scheme != NULL)) {
1755         /*
1756          * The URI is absolute don't modify.
1757          */
1758         val = g_strdup(uri);
1759         goto done;
1760     }
1761     if (base == NULL) {
1762         ret = -1;
1763     } else {
1764         bas = uri_new();
1765         ret = uri_parse_into(bas, base);
1766     }
1767     if (ret != 0) {
1768         if (ref) {
1769             val = uri_to_string(ref);
1770         }
1771         goto done;
1772     }
1773     if (ref == NULL) {
1774         /*
1775          * the base fragment must be ignored
1776          */
1777         g_free(bas->fragment);
1778         bas->fragment = NULL;
1779         val = uri_to_string(bas);
1780         goto done;
1781     }
1782 
1783     /*
1784      * 2) If the path component is empty and the scheme, authority, and
1785      *    query components are undefined, then it is a reference to the
1786      *    current document and we are done.  Otherwise, the reference URI's
1787      *    query and fragment components are defined as found (or not found)
1788      *    within the URI reference and not inherited from the base URI.
1789      *
1790      *    NOTE that in modern browsers, the parsing differs from the above
1791      *    in the following aspect:  the query component is allowed to be
1792      *    defined while still treating this as a reference to the current
1793      *    document.
1794      */
1795     res = uri_new();
1796     if ((ref->scheme == NULL) && (ref->path == NULL) &&
1797         ((ref->authority == NULL) && (ref->server == NULL))) {
1798         res->scheme = g_strdup(bas->scheme);
1799         if (bas->authority != NULL) {
1800             res->authority = g_strdup(bas->authority);
1801         } else if (bas->server != NULL) {
1802             res->server = g_strdup(bas->server);
1803             res->user = g_strdup(bas->user);
1804             res->port = bas->port;
1805         }
1806         res->path = g_strdup(bas->path);
1807         if (ref->query != NULL) {
1808             res->query = g_strdup(ref->query);
1809         } else {
1810             res->query = g_strdup(bas->query);
1811         }
1812         res->fragment = g_strdup(ref->fragment);
1813         goto step_7;
1814     }
1815 
1816     /*
1817      * 3) If the scheme component is defined, indicating that the reference
1818      *    starts with a scheme name, then the reference is interpreted as an
1819      *    absolute URI and we are done.  Otherwise, the reference URI's
1820      *    scheme is inherited from the base URI's scheme component.
1821      */
1822     if (ref->scheme != NULL) {
1823         val = uri_to_string(ref);
1824         goto done;
1825     }
1826     res->scheme = g_strdup(bas->scheme);
1827 
1828     res->query = g_strdup(ref->query);
1829     res->fragment = g_strdup(ref->fragment);
1830 
1831     /*
1832      * 4) If the authority component is defined, then the reference is a
1833      *    network-path and we skip to step 7.  Otherwise, the reference
1834      *    URI's authority is inherited from the base URI's authority
1835      *    component, which will also be undefined if the URI scheme does not
1836      *    use an authority component.
1837      */
1838     if ((ref->authority != NULL) || (ref->server != NULL)) {
1839         if (ref->authority != NULL) {
1840             res->authority = g_strdup(ref->authority);
1841         } else {
1842             res->server = g_strdup(ref->server);
1843             res->user = g_strdup(ref->user);
1844             res->port = ref->port;
1845         }
1846         res->path = g_strdup(ref->path);
1847         goto step_7;
1848     }
1849     if (bas->authority != NULL) {
1850         res->authority = g_strdup(bas->authority);
1851     } else if (bas->server != NULL) {
1852         res->server = g_strdup(bas->server);
1853         res->user = g_strdup(bas->user);
1854         res->port = bas->port;
1855     }
1856 
1857     /*
1858      * 5) If the path component begins with a slash character ("/"), then
1859      *    the reference is an absolute-path and we skip to step 7.
1860      */
1861     if ((ref->path != NULL) && (ref->path[0] == '/')) {
1862         res->path = g_strdup(ref->path);
1863         goto step_7;
1864     }
1865 
1866     /*
1867      * 6) If this step is reached, then we are resolving a relative-path
1868      *    reference.  The relative path needs to be merged with the base
1869      *    URI's path.  Although there are many ways to do this, we will
1870      *    describe a simple method using a separate string buffer.
1871      *
1872      * Allocate a buffer large enough for the result string.
1873      */
1874     len = 2; /* extra / and 0 */
1875     if (ref->path != NULL) {
1876         len += strlen(ref->path);
1877     }
1878     if (bas->path != NULL) {
1879         len += strlen(bas->path);
1880     }
1881     res->path = g_malloc(len);
1882     res->path[0] = 0;
1883 
1884     /*
1885      * a) All but the last segment of the base URI's path component is
1886      *    copied to the buffer.  In other words, any characters after the
1887      *    last (right-most) slash character, if any, are excluded.
1888      */
1889     cur = 0;
1890     out = 0;
1891     if (bas->path != NULL) {
1892         while (bas->path[cur] != 0) {
1893             while ((bas->path[cur] != 0) && (bas->path[cur] != '/')) {
1894                 cur++;
1895             }
1896             if (bas->path[cur] == 0) {
1897                 break;
1898             }
1899 
1900             cur++;
1901             while (out < cur) {
1902                 res->path[out] = bas->path[out];
1903                 out++;
1904             }
1905         }
1906     }
1907     res->path[out] = 0;
1908 
1909     /*
1910      * b) The reference's path component is appended to the buffer
1911      *    string.
1912      */
1913     if (ref->path != NULL && ref->path[0] != 0) {
1914         indx = 0;
1915         /*
1916          * Ensure the path includes a '/'
1917          */
1918         if ((out == 0) && (bas->server != NULL)) {
1919             res->path[out++] = '/';
1920         }
1921         while (ref->path[indx] != 0) {
1922             res->path[out++] = ref->path[indx++];
1923         }
1924     }
1925     res->path[out] = 0;
1926 
1927     /*
1928      * Steps c) to h) are really path normalization steps
1929      */
1930     normalize_uri_path(res->path);
1931 
1932 step_7:
1933 
1934     /*
1935      * 7) The resulting URI components, including any inherited from the
1936      *    base URI, are recombined to give the absolute form of the URI
1937      *    reference.
1938      */
1939     val = uri_to_string(res);
1940 
1941 done:
1942     uri_free(ref);
1943     uri_free(bas);
1944     uri_free(res);
1945     return val;
1946 }
1947 
1948 /**
1949  * uri_resolve_relative:
1950  * @URI:  the URI reference under consideration
1951  * @base:  the base value
1952  *
1953  * Expresses the URI of the reference in terms relative to the
1954  * base.  Some examples of this operation include:
1955  *     base = "http://site1.com/docs/book1.html"
1956  *        URI input                        URI returned
1957  *     docs/pic1.gif                    pic1.gif
1958  *     docs/img/pic1.gif                img/pic1.gif
1959  *     img/pic1.gif                     ../img/pic1.gif
1960  *     http://site1.com/docs/pic1.gif   pic1.gif
1961  *     http://site2.com/docs/pic1.gif   http://site2.com/docs/pic1.gif
1962  *
1963  *     base = "docs/book1.html"
1964  *        URI input                        URI returned
1965  *     docs/pic1.gif                    pic1.gif
1966  *     docs/img/pic1.gif                img/pic1.gif
1967  *     img/pic1.gif                     ../img/pic1.gif
1968  *     http://site1.com/docs/pic1.gif   http://site1.com/docs/pic1.gif
1969  *
1970  *
1971  * Note: if the URI reference is really weird or complicated, it may be
1972  *       worthwhile to first convert it into a "nice" one by calling
1973  *       uri_resolve (using 'base') before calling this routine,
1974  *       since this routine (for reasonable efficiency) assumes URI has
1975  *       already been through some validation.
1976  *
1977  * Returns a new URI string (to be freed by the caller) or NULL in case
1978  * error.
1979  */
1980 char *uri_resolve_relative(const char *uri, const char *base)
1981 {
1982     char *val = NULL;
1983     int ret;
1984     int ix;
1985     int pos = 0;
1986     int nbslash = 0;
1987     int len;
1988     URI *ref = NULL;
1989     URI *bas = NULL;
1990     char *bptr, *uptr, *vptr;
1991     int remove_path = 0;
1992 
1993     if ((uri == NULL) || (*uri == 0)) {
1994         return NULL;
1995     }
1996 
1997     /*
1998      * First parse URI into a standard form
1999      */
2000     ref = uri_new();
2001     /* If URI not already in "relative" form */
2002     if (uri[0] != '.') {
2003         ret = uri_parse_into(ref, uri);
2004         if (ret != 0) {
2005             goto done; /* Error in URI, return NULL */
2006         }
2007     } else {
2008         ref->path = g_strdup(uri);
2009     }
2010 
2011     /*
2012      * Next parse base into the same standard form
2013      */
2014     if ((base == NULL) || (*base == 0)) {
2015         val = g_strdup(uri);
2016         goto done;
2017     }
2018     bas = uri_new();
2019     if (base[0] != '.') {
2020         ret = uri_parse_into(bas, base);
2021         if (ret != 0) {
2022             goto done; /* Error in base, return NULL */
2023         }
2024     } else {
2025         bas->path = g_strdup(base);
2026     }
2027 
2028     /*
2029      * If the scheme / server on the URI differs from the base,
2030      * just return the URI
2031      */
2032     if ((ref->scheme != NULL) &&
2033         ((bas->scheme == NULL) || (strcmp(bas->scheme, ref->scheme)) ||
2034          (strcmp(bas->server, ref->server)))) {
2035         val = g_strdup(uri);
2036         goto done;
2037     }
2038     if (bas->path == ref->path ||
2039         (bas->path && ref->path && !strcmp(bas->path, ref->path))) {
2040         val = g_strdup("");
2041         goto done;
2042     }
2043     if (bas->path == NULL) {
2044         val = g_strdup(ref->path);
2045         goto done;
2046     }
2047     if (ref->path == NULL) {
2048         ref->path = (char *)"/";
2049         remove_path = 1;
2050     }
2051 
2052     /*
2053      * At this point (at last!) we can compare the two paths
2054      *
2055      * First we take care of the special case where either of the
2056      * two path components may be missing (bug 316224)
2057      */
2058     if (bas->path == NULL) {
2059         if (ref->path != NULL) {
2060             uptr = ref->path;
2061             if (*uptr == '/') {
2062                 uptr++;
2063             }
2064             /* exception characters from uri_to_string */
2065             val = uri_string_escape(uptr, "/;&=+$,");
2066         }
2067         goto done;
2068     }
2069     bptr = bas->path;
2070     if (ref->path == NULL) {
2071         for (ix = 0; bptr[ix] != 0; ix++) {
2072             if (bptr[ix] == '/') {
2073                 nbslash++;
2074             }
2075         }
2076         uptr = NULL;
2077         len = 1; /* this is for a string terminator only */
2078     } else {
2079         /*
2080          * Next we compare the two strings and find where they first differ
2081          */
2082         if ((ref->path[pos] == '.') && (ref->path[pos + 1] == '/')) {
2083             pos += 2;
2084         }
2085         if ((*bptr == '.') && (bptr[1] == '/')) {
2086             bptr += 2;
2087         } else if ((*bptr == '/') && (ref->path[pos] != '/')) {
2088             bptr++;
2089         }
2090         while ((bptr[pos] == ref->path[pos]) && (bptr[pos] != 0)) {
2091             pos++;
2092         }
2093 
2094         if (bptr[pos] == ref->path[pos]) {
2095             val = g_strdup("");
2096             goto done; /* (I can't imagine why anyone would do this) */
2097         }
2098 
2099         /*
2100          * In URI, "back up" to the last '/' encountered.  This will be the
2101          * beginning of the "unique" suffix of URI
2102          */
2103         ix = pos;
2104         if ((ref->path[ix] == '/') && (ix > 0)) {
2105             ix--;
2106         } else if ((ref->path[ix] == 0) && (ix > 1)
2107                 && (ref->path[ix - 1] == '/')) {
2108             ix -= 2;
2109         }
2110         for (; ix > 0; ix--) {
2111             if (ref->path[ix] == '/') {
2112                 break;
2113             }
2114         }
2115         if (ix == 0) {
2116             uptr = ref->path;
2117         } else {
2118             ix++;
2119             uptr = &ref->path[ix];
2120         }
2121 
2122         /*
2123          * In base, count the number of '/' from the differing point
2124          */
2125         if (bptr[pos] != ref->path[pos]) { /* check for trivial URI == base */
2126             for (; bptr[ix] != 0; ix++) {
2127                 if (bptr[ix] == '/') {
2128                     nbslash++;
2129                 }
2130             }
2131         }
2132         len = strlen(uptr) + 1;
2133     }
2134 
2135     if (nbslash == 0) {
2136         if (uptr != NULL) {
2137             /* exception characters from uri_to_string */
2138             val = uri_string_escape(uptr, "/;&=+$,");
2139         }
2140         goto done;
2141     }
2142 
2143     /*
2144      * Allocate just enough space for the returned string -
2145      * length of the remainder of the URI, plus enough space
2146      * for the "../" groups, plus one for the terminator
2147      */
2148     val = g_malloc(len + 3 * nbslash);
2149     vptr = val;
2150     /*
2151      * Put in as many "../" as needed
2152      */
2153     for (; nbslash > 0; nbslash--) {
2154         *vptr++ = '.';
2155         *vptr++ = '.';
2156         *vptr++ = '/';
2157     }
2158     /*
2159      * Finish up with the end of the URI
2160      */
2161     if (uptr != NULL) {
2162         if ((vptr > val) && (len > 0) && (uptr[0] == '/') &&
2163             (vptr[-1] == '/')) {
2164             memcpy(vptr, uptr + 1, len - 1);
2165             vptr[len - 2] = 0;
2166         } else {
2167             memcpy(vptr, uptr, len);
2168             vptr[len - 1] = 0;
2169         }
2170     } else {
2171         vptr[len - 1] = 0;
2172     }
2173 
2174     /* escape the freshly-built path */
2175     vptr = val;
2176     /* exception characters from uri_to_string */
2177     val = uri_string_escape(vptr, "/;&=+$,");
2178     g_free(vptr);
2179 
2180 done:
2181     /*
2182      * Free the working variables
2183      */
2184     if (remove_path != 0) {
2185         ref->path = NULL;
2186     }
2187     uri_free(ref);
2188     uri_free(bas);
2189 
2190     return val;
2191 }
2192 
2193 /*
2194  * Utility functions to help parse and assemble query strings.
2195  */
2196 
2197 struct QueryParams *query_params_new(int init_alloc)
2198 {
2199     struct QueryParams *ps;
2200 
2201     if (init_alloc <= 0) {
2202         init_alloc = 1;
2203     }
2204 
2205     ps = g_new(QueryParams, 1);
2206     ps->n = 0;
2207     ps->alloc = init_alloc;
2208     ps->p = g_new(QueryParam, ps->alloc);
2209 
2210     return ps;
2211 }
2212 
2213 /* Ensure there is space to store at least one more parameter
2214  * at the end of the set.
2215  */
2216 static int query_params_append(struct QueryParams *ps, const char *name,
2217                                const char *value)
2218 {
2219     if (ps->n >= ps->alloc) {
2220         ps->p = g_renew(QueryParam, ps->p, ps->alloc * 2);
2221         ps->alloc *= 2;
2222     }
2223 
2224     ps->p[ps->n].name = g_strdup(name);
2225     ps->p[ps->n].value = g_strdup(value);
2226     ps->p[ps->n].ignore = 0;
2227     ps->n++;
2228 
2229     return 0;
2230 }
2231 
2232 void query_params_free(struct QueryParams *ps)
2233 {
2234     int i;
2235 
2236     for (i = 0; i < ps->n; ++i) {
2237         g_free(ps->p[i].name);
2238         g_free(ps->p[i].value);
2239     }
2240     g_free(ps->p);
2241     g_free(ps);
2242 }
2243 
2244 struct QueryParams *query_params_parse(const char *query)
2245 {
2246     struct QueryParams *ps;
2247     const char *end, *eq;
2248 
2249     ps = query_params_new(0);
2250     if (!query || query[0] == '\0') {
2251         return ps;
2252     }
2253 
2254     while (*query) {
2255         char *name = NULL, *value = NULL;
2256 
2257         /* Find the next separator, or end of the string. */
2258         end = strchr(query, '&');
2259         if (!end) {
2260             end = qemu_strchrnul(query, ';');
2261         }
2262 
2263         /* Find the first '=' character between here and end. */
2264         eq = strchr(query, '=');
2265         if (eq && eq >= end) {
2266             eq = NULL;
2267         }
2268 
2269         /* Empty section (eg. "&&"). */
2270         if (end == query) {
2271             goto next;
2272         }
2273 
2274         /* If there is no '=' character, then we have just "name"
2275          * and consistent with CGI.pm we assume value is "".
2276          */
2277         else if (!eq) {
2278             name = uri_string_unescape(query, end - query, NULL);
2279             value = NULL;
2280         }
2281         /* Or if we have "name=" here (works around annoying
2282          * problem when calling uri_string_unescape with len = 0).
2283          */
2284         else if (eq + 1 == end) {
2285             name = uri_string_unescape(query, eq - query, NULL);
2286             value = g_new0(char, 1);
2287         }
2288         /* If the '=' character is at the beginning then we have
2289          * "=value" and consistent with CGI.pm we _ignore_ this.
2290          */
2291         else if (query == eq) {
2292             goto next;
2293         }
2294 
2295         /* Otherwise it's "name=value". */
2296         else {
2297             name = uri_string_unescape(query, eq - query, NULL);
2298             value = uri_string_unescape(eq + 1, end - (eq + 1), NULL);
2299         }
2300 
2301         /* Append to the parameter set. */
2302         query_params_append(ps, name, value);
2303         g_free(name);
2304         g_free(value);
2305 
2306     next:
2307         query = end;
2308         if (*query) {
2309             query++; /* skip '&' separator */
2310         }
2311     }
2312 
2313     return ps;
2314 }
2315