ox 2.14.27 → 2.14.29

data/ext/ox/builder.c

@@ -14,6 +14,8 @@
 #include "ruby.h"
 #include "ruby/encoding.h"
 #include "ruby/version.h"
+#include "xml_check.h"
+#include "xml_str.h"
 
 #define MAX_DEPTH 128
 
@@ -92,20 +94,13 @@ static const char xml_element_chars[257] = "\
 11111111111111111111111111111111\
 11111111111111111111111111111111";
 
-inline static size_t xml_str_len(const unsigned char *str, size_t len, const char *table) {
-    size_t size = 0;
-
-    for (; 0 < len; str++, len--) {
-        size += table[*str];
-    }
-    return size - len * (size_t)'0';
-}
-
 static void append_indent(Builder b) {
     if (0 >= b->indent) {
         return;
     }
-    if (b->buf.head < b->buf.tail) {
+    // pos and not the buffer: a file builder empties the buffer on every flush,
+    // which would read as the start of the document again.
+    if (0 < b->pos) {
         int cnt = (b->indent * (b->depth + 1)) + 1;
 
         if (sizeof(indent_spaces) <= (size_t)cnt) {
@@ -118,9 +113,62 @@ static void append_indent(Builder b) {
     }
 }
 
-static void append_string(Builder b, const char *str, size_t size, const char *table, bool strip_invalid_chars) {
+// Returns the escaped size append_string() needs, and raises first if the value
+// holds a character XML has no way to write. append_string() raises on the same
+// byte, but only once the delimiters around the value are already in the buffer
+// and, for an element, once the element is on the stack, and nothing takes those
+// back. So the writers ask here before they write anything.
+//
+// Only a value whose escaped form is longer can hold one, since an invalid byte
+// counts 10, so the common case is the one walk append_string() always did.
+inline static size_t check_string(const char *str, size_t size, const char *table) {
     size_t xsize = xml_str_len((const unsigned char *)str, size, table);
 
+    if (xsize != size) {
+        const unsigned char *bad = xml_first_invalid((const unsigned char *)str, size);
+
+        if (NULL != bad) {
+            rb_raise(ox_syntax_error_class, "'\\#x%02x' is not a valid XML character.", *bad);
+        }
+    }
+    return xsize;
+}
+
+// One of the instruct() attributes, which are written from the Hash rather than
+// passed in. A value of the wrong type is left to the type check that already
+// refuses it further down.
+inline static void check_instruct_value(VALUE attrs, VALUE key) {
+    volatile VALUE v = rb_hash_lookup(attrs, key);
+
+    if (Qnil != v && rb_cString == rb_obj_class(v)) {
+        check_unescaped(StringValuePtr(v), (size_t)RSTRING_LEN(v));
+    }
+}
+
+// Resolves a Symbol or String name to bytes and checks it, for the writers that
+// take either. sym holds the Symbol's name String for as long as *strp is used.
+inline static long check_name(VALUE v, volatile VALUE *sym, const char **strp, size_t *xsizep, const char *msg) {
+    long len;
+
+    switch (rb_type(v)) {
+    case T_STRING:
+        *strp = StringValuePtr(v);
+        len   = RSTRING_LEN(v);
+        break;
+    case T_SYMBOL:
+        *sym  = rb_sym2str(v);
+        *strp = RSTRING_PTR(*sym);
+        len   = RSTRING_LEN(*sym);
+        break;
+    default: rb_raise(ox_arg_error_class, "%s", msg); break;
+    }
+    *xsizep = check_string(*strp, (size_t)len, xml_element_chars);
+
+    return len;
+}
+
+static void
+append_string(Builder b, const char *str, size_t size, const char *table, size_t xsize, bool strip_invalid_chars) {
     if (size == xsize) {
         const char *s   = str;
         const char *end = str + size;
@@ -135,45 +183,107 @@ static void append_string(Builder b, const char *str, size_t size, const char *t
         }
         b->pos += size;
     } else {
-        char   buf[256];
-        char  *end = buf + sizeof(buf) - 1;
-        char  *bp  = buf;
-        size_t i   = size;
-        int    fcnt;
-
-        for (; '\0' != *str && 0 < i; i--, str++) {
-            if ('1' == (fcnt = table[(unsigned char)*str])) {
-                if (end <= bp) {
+        char        buf[256];
+        char       *bp   = buf;
+        char       *bend = buf + sizeof(buf) - 1;
+        const char *send = str + size;
+
+        while (str < send) {
+            /* Copy runs of pass-through bytes a word at a time into the staging
+             * buffer. A clean word has no byte below 0x20, so it can hold no
+             * newline and no '\0': col and pos advance by the whole word and the
+             * line is unchanged. On a hit the store is kept up to the first
+             * flagged byte and the rest is redone by the loops below.
+             */
+            while (str + 8 <= send) {
+                uint64_t v;
+                uint64_t mask;
+
+                memcpy(&v, str, 8);
+                mask = xml_bytes_of_interest(v);
+                if (bend < bp + 8) {
                     buf_append_string(&b->buf, buf, bp - buf);
                     bp = buf;
                 }
-                if ('\n' == *str) {
-                    b->line++;
-                    b->col = 1;
-                } else {
-                    b->col++;
+                memcpy(bp, str, 8);
+                if (0 != mask) {
+                    int n = xml_first_of_interest((const unsigned char *)str, mask);
+
+                    bp += n;
+                    str += n;
+                    b->col += n;
+                    b->pos += n;
+                    break;
                 }
-                b->pos++;
-                *bp++ = *str;
-            } else {
-                b->pos += fcnt - '0';
-                b->col += fcnt - '0';
-                if (buf < bp) {
+                bp += 8;
+                str += 8;
+                b->col += 8;
+                b->pos += 8;
+            }
+            /* Pass-through bytes the word loop left: the tail shorter than a
+             * word. These are all >= 0x20 and not escape characters, so no
+             * newline check is needed.
+             */
+            while (str < send) {
+                unsigned char c = (unsigned char)*str;
+
+                if (c < 0x20 || '"' == c || '\'' == c || '&' == c || '<' == c || '>' == c) {
+                    break;
+                }
+                if (bend <= bp) {
                     buf_append_string(&b->buf, buf, bp - buf);
                     bp = buf;
                 }
-                switch (*str) {
-                case '"': buf_append_string(&b->buf, "&quot;", 6); break;
-                case '&': buf_append_string(&b->buf, "&amp;", 5); break;
-                case '\'': buf_append_string(&b->buf, "&apos;", 6); break;
-                case '<': buf_append_string(&b->buf, "&lt;", 4); break;
-                case '>': buf_append_string(&b->buf, "&gt;", 4); break;
-                default:
-                    // Must be one of the invalid characters.
-                    if (!strip_invalid_chars) {
-                        rb_raise(ox_syntax_error_class, "'\\#x%02x' is not a valid XML character.", *str);
+                *bp++ = *str++;
+                b->col++;
+                b->pos++;
+            }
+            /* One byte the predicate flagged: an escape, an invalid character,
+             * or a byte the table keeps unchanged ('"' and '\'' in the element
+             * table, and 0x09/0x0a/0x0d in every table).
+             */
+            if (str < send) {
+                int fcnt = table[(unsigned char)*str];
+
+                if ('1' == fcnt) {
+                    if (bend <= bp) {
+                        buf_append_string(&b->buf, buf, bp - buf);
+                        bp = buf;
                     }
-                    break;
+                    if ('\n' == *str) {
+                        b->line++;
+                        b->col = 1;
+                    } else {
+                        b->col++;
+                    }
+                    b->pos++;
+                    *bp++ = *str++;
+                } else {
+                    size_t written = (size_t)(fcnt - '0');
+
+                    if (buf < bp) {
+                        buf_append_string(&b->buf, buf, bp - buf);
+                        bp = buf;
+                    }
+                    switch (*str) {
+                    case '"': buf_append_string(&b->buf, "&quot;", 6); break;
+                    case '&': buf_append_string(&b->buf, "&amp;", 5); break;
+                    case '\'': buf_append_string(&b->buf, "&apos;", 6); break;
+                    case '<': buf_append_string(&b->buf, "&lt;", 4); break;
+                    case '>': buf_append_string(&b->buf, "&gt;", 4); break;
+                    default:
+                        // Must be one of the invalid characters. The table holds
+                        // 10 for those, the longest escape, but nothing is
+                        // written for them here.
+                        if (!strip_invalid_chars) {
+                            rb_raise(ox_syntax_error_class, "'\\#x%02x' is not a valid XML character.", *str);
+                        }
+                        written = 0;
+                        break;
+                    }
+                    b->pos += written;
+                    b->col += written;
+                    str++;
                 }
             }
         }
@@ -185,21 +295,12 @@ static void append_string(Builder b, const char *str, size_t size, const char *t
 }
 
 static void append_sym_str(Builder b, VALUE v) {
-    const char *s;
-    long        len;
+    volatile VALUE sym = Qnil;
+    const char    *s;
+    size_t         xsize = 0;
+    long           len   = check_name(v, &sym, &s, &xsize, "expected a Symbol or String");
 
-    switch (rb_type(v)) {
-    case T_STRING:
-        s   = StringValuePtr(v);
-        len = RSTRING_LEN(v);
-        break;
-    case T_SYMBOL:
-        s   = rb_id2name(SYM2ID(v));
-        len = strlen(s);
-        break;
-    default: rb_raise(ox_arg_error_class, "expected a Symbol or String"); break;
-    }
-    append_string(b, s, len, xml_element_chars, false);
+    append_string(b, s, len, xml_element_chars, xsize, false);
 }
 
 static void i_am_a_child(Builder b, bool is_text) {
@@ -219,17 +320,30 @@ static void i_am_a_child(Builder b, bool is_text) {
 }
 
 static int append_attr(VALUE key, VALUE value, VALUE bv) {
-    Builder b = (Builder)bv;
+    Builder        b   = (Builder)bv;
+    volatile VALUE sym = Qnil;
+    const char    *ks;
+    long           klen;
+    size_t         kx;
+    size_t         vsize;
+    size_t         vx;
+
+    // Both halves before the space: an attribute is either written whole or not
+    // at all, and the element it belongs to is left as it was.
+    Check_Type(value, T_STRING);
+    klen = check_name(key, &sym, &ks, &kx, "expected a Symbol or String");
+    check_name_chars(ks, (size_t)klen, true);
+    vsize = (size_t)RSTRING_LEN(value);
+    vx    = check_string(StringValuePtr(value), vsize, xml_attr_chars);
 
     buf_append(&b->buf, ' ');
     b->col++;
     b->pos++;
-    append_sym_str(b, key);
+    append_string(b, ks, klen, xml_element_chars, kx, false);
     buf_append_string(&b->buf, "=\"", 2);
     b->col += 2;
     b->pos += 2;
-    Check_Type(value, T_STRING);
-    append_string(b, StringValuePtr(value), (int)RSTRING_LEN(value), xml_attr_chars, false);
+    append_string(b, StringValuePtr(value), vsize, xml_attr_chars, vx, false);
     buf_append(&b->buf, '"');
     b->col++;
     b->pos++;
@@ -257,7 +371,7 @@ static void builder_free(void *ptr) {
     }
     b = (Builder)ptr;
     buf_cleanup(&b->buf);
-    for (e = b->stack, d = b->depth; 0 < d; d--, e++) {
+    for (e = b->stack, d = b->depth; 0 <= d; d--, e++) {
         if (e->name != e->buf) {
             free(e->name);
         }
@@ -278,10 +392,17 @@ static void pop(Builder b) {
             append_indent(b);
         }
         buf_append_string(&b->buf, "</", 2);
-        append_string(b, e->name, e->len, xml_element_chars, false);
+        append_string(b,
+                      e->name,
+                      e->len,
+                      xml_element_chars,
+                      xml_str_len((const unsigned char *)e->name, e->len, xml_element_chars),
+                      false);
         buf_append(&b->buf, '>');
-        b->col += e->len + 3;
-        b->pos += e->len + 3;
+        // append_string() already counted the name, so this is only the "</"
+        // and the ">".
+        b->col += 3;
+        b->pos += 3;
         if (e->buf != e->name) {
             free(e->name);
             e->name = 0;
@@ -311,18 +432,21 @@ static void bclose(Builder b) {
 
 static VALUE to_s(Builder b) {
     volatile VALUE rstr;
+    size_t         len;
 
     if (0 != b->buf.fd) {
         rb_raise(ox_arg_error_class, "can not create a String with a stream or file builder.");
     }
-    if (0 <= b->indent && '\n' != *(b->buf.tail - 1)) {
-        buf_append(&b->buf, '\n');
-        b->line++;
-        b->col = 1;
-        b->pos++;
-    }
+    len          = buf_len(&b->buf);
     *b->buf.tail = '\0';  // for debugging
-    rstr         = rb_str_new(b->buf.head, buf_len(&b->buf));
+    rstr         = rb_str_new(b->buf.head, len);
+    // The closing newline goes on the String and not the buffer. Appended to the
+    // buffer it stays there, so a to_s taken before the document is finished
+    // leaves a newline in the middle of it, and in the middle of a value if that
+    // is where the builder was.
+    if (0 <= b->indent && (0 == len || '\n' != b->buf.head[len - 1])) {
+        rb_str_cat(rstr, "\n", 1);
+    }
 
     if ('\0' != *b->encoding) {
         rb_enc_associate(rstr, rb_enc_find(b->encoding));
@@ -396,7 +520,7 @@ static VALUE builder_file(int argc, VALUE *argv, VALUE self) {
         rb_raise(ox_arg_error_class, "missing filename");
     }
     Check_Type(*argv, T_STRING);
-    if (NULL == (f = fopen(StringValuePtr(*argv), "w"))) {
+    if (NULL == (f = fopen(StringValuePtr(*argv), "wb"))) {
         xfree(b);
         rb_raise(rb_eIOError, "%s\n", strerror(errno));
     }
@@ -494,6 +618,20 @@ static VALUE builder_instruct(int argc, VALUE *argv, VALUE self) {
     Builder b;
 
     TypedData_Get_Struct(self, struct _builder, &ox_builder_type, b);
+    if (0 < argc) {
+        volatile VALUE nsym = Qnil;
+        const char    *nstr;
+        size_t         nx;
+
+        check_name(*argv, &nsym, &nstr, &nx, "expected a Symbol or String");
+        if (1 < argc && rb_cHash == rb_obj_class(argv[1])) {
+            // The "<?" and the target are out by the time the values are
+            // written, so a raise down there would leave them in the buffer.
+            check_instruct_value(argv[1], ox_version_sym);
+            check_instruct_value(argv[1], ox_encoding_sym);
+            check_instruct_value(argv[1], ox_standalone_sym);
+        }
+    }
     i_am_a_child(b, false);
     append_indent(b);
     if (0 == argc) {
@@ -562,33 +700,29 @@ static VALUE builder_instruct(int argc, VALUE *argv, VALUE self) {
  * - +attributes+ - (Hash) of the element
  */
 static VALUE builder_element(int argc, VALUE *argv, VALUE self) {
-    Builder     b;
-    Element     e;
-    const char *name;
-    long        len;
+    Builder        b;
+    Element        e;
+    volatile VALUE sym   = Qnil;
+    size_t         xsize = 0;
+    const char    *name;
+    long           len;
 
     TypedData_Get_Struct(self, struct _builder, &ox_builder_type, b);
 
     if (1 > argc) {
         rb_raise(ox_arg_error_class, "missing element name");
     }
+    // Everything that can raise has to run before the first write, or the raise
+    // leaves an element started that no later call can finish or take back. It
+    // also has to run before b->depth++, or the stack slot is never filled in.
+    len = check_name(*argv, &sym, &name, &xsize, "expected a Symbol or String for an element name");
+    check_name_chars(name, (size_t)len, false);
+    if (MAX_DEPTH <= b->depth + 1) {
+        rb_raise(ox_arg_error_class, "XML too deeply nested");
+    }
     i_am_a_child(b, false);
     append_indent(b);
     b->depth++;
-    if (MAX_DEPTH <= b->depth) {
-        rb_raise(ox_arg_error_class, "XML too deeply nested");
-    }
-    switch (rb_type(*argv)) {
-    case T_STRING:
-        name = StringValuePtr(*argv);
-        len  = RSTRING_LEN(*argv);
-        break;
-    case T_SYMBOL:
-        name = rb_id2name(SYM2ID(*argv));
-        len  = strlen(name);
-        break;
-    default: rb_raise(ox_arg_error_class, "expected a Symbol or String for an element name"); break;
-    }
     e = &b->stack[b->depth];
     if (sizeof(e->buf) <= (size_t)len) {
         e->name = strdup(name);
@@ -604,7 +738,7 @@ static VALUE builder_element(int argc, VALUE *argv, VALUE self) {
     buf_append(&b->buf, '<');
     b->col++;
     b->pos++;
-    append_string(b, e->name, len, xml_element_chars, false);
+    append_string(b, e->name, len, xml_element_chars, xsize, false);
     if (1 < argc && T_HASH == rb_type(argv[1])) {
         rb_hash_foreach(argv[1], append_attr, (VALUE)b);
     }
@@ -624,32 +758,25 @@ static VALUE builder_element(int argc, VALUE *argv, VALUE self) {
  * - +attributes+ - (Hash) of the element
  */
 static VALUE builder_void_element(int argc, VALUE *argv, VALUE self) {
-    Builder     b;
-    const char *name;
-    long        len;
+    Builder        b;
+    volatile VALUE sym   = Qnil;
+    size_t         xsize = 0;
+    const char    *name;
+    long           len;
 
     TypedData_Get_Struct(self, struct _builder, &ox_builder_type, b);
 
     if (1 > argc) {
         rb_raise(ox_arg_error_class, "missing element name");
     }
+    len = check_name(*argv, &sym, &name, &xsize, "expected a Symbol or String for an element name");
+    check_name_chars(name, (size_t)len, false);
     i_am_a_child(b, false);
     append_indent(b);
-    switch (rb_type(*argv)) {
-    case T_STRING:
-        name = StringValuePtr(*argv);
-        len  = RSTRING_LEN(*argv);
-        break;
-    case T_SYMBOL:
-        name = rb_id2name(SYM2ID(*argv));
-        len  = strlen(name);
-        break;
-    default: rb_raise(ox_arg_error_class, "expected a Symbol or String for an element name"); break;
-    }
     buf_append(&b->buf, '<');
     b->col++;
     b->pos++;
-    append_string(b, name, len, xml_element_chars, false);
+    append_string(b, name, len, xml_element_chars, xsize, false);
     if (1 < argc && T_HASH == rb_type(argv[1])) {
         rb_hash_foreach(argv[1], append_attr, (VALUE)b);
     }
@@ -668,18 +795,22 @@ static VALUE builder_void_element(int argc, VALUE *argv, VALUE self) {
  */
 static VALUE builder_comment(VALUE self, VALUE text) {
     Builder b;
+    size_t  size;
+    size_t  xsize;
 
     TypedData_Get_Struct(self, struct _builder, &ox_builder_type, b);
     rb_check_type(text, T_STRING);
+    size  = (size_t)RSTRING_LEN(text);
+    xsize = check_string(StringValuePtr(text), size, xml_element_chars);
     i_am_a_child(b, false);
     append_indent(b);
     buf_append_string(&b->buf, "<!--", 4);
-    b->col += 5;
-    b->pos += 5;
-    append_string(b, StringValuePtr(text), RSTRING_LEN(text), xml_element_chars, false);
+    b->col += 4;
+    b->pos += 4;
+    append_string(b, StringValuePtr(text), size, xml_element_chars, xsize, false);
     buf_append_string(&b->buf, "-->", 3);
-    b->col += 5;
-    b->pos += 5;
+    b->col += 3;
+    b->pos += 3;
 
     return Qnil;
 }
@@ -691,15 +822,19 @@ static VALUE builder_comment(VALUE self, VALUE text) {
  */
 static VALUE builder_doctype(VALUE self, VALUE text) {
     Builder b;
+    size_t  size;
+    size_t  xsize;
 
     TypedData_Get_Struct(self, struct _builder, &ox_builder_type, b);
     rb_check_type(text, T_STRING);
+    size  = (size_t)RSTRING_LEN(text);
+    xsize = check_string(StringValuePtr(text), size, xml_element_chars);
     i_am_a_child(b, false);
     append_indent(b);
     buf_append_string(&b->buf, "<!DOCTYPE ", 10);
     b->col += 10;
     b->pos += 10;
-    append_string(b, StringValuePtr(text), RSTRING_LEN(text), xml_element_chars, false);
+    append_string(b, StringValuePtr(text), size, xml_element_chars, xsize, false);
     buf_append(&b->buf, '>');
     b->col++;
     b->pos++;
@@ -717,6 +852,8 @@ static VALUE builder_text(int argc, VALUE *argv, VALUE self) {
     Builder        b;
     volatile VALUE v;
     volatile VALUE strip_invalid_chars;
+    size_t         size;
+    size_t         xsize;
 
     TypedData_Get_Struct(self, struct _builder, &ox_builder_type, b);
 
@@ -730,9 +867,14 @@ static VALUE builder_text(int argc, VALUE *argv, VALUE self) {
         strip_invalid_chars = Qfalse;
     }
 
-    v = rb_String(v);
+    v    = rb_String(v);
+    size = (size_t)RSTRING_LEN(v);
+    // Stripping is allowed to drop the byte, so it is the one writer that does
+    // not have to refuse the value up front.
+    xsize = RTEST(strip_invalid_chars) ? xml_str_len((const unsigned char *)StringValuePtr(v), size, xml_element_chars)
+                                       : check_string(StringValuePtr(v), size, xml_element_chars);
     i_am_a_child(b, true);
-    append_string(b, StringValuePtr(v), RSTRING_LEN(v), xml_element_chars, RTEST(strip_invalid_chars));
+    append_string(b, StringValuePtr(v), size, xml_element_chars, xsize, RTEST(strip_invalid_chars));
 
     return Qnil;
 }
@@ -748,29 +890,42 @@ static VALUE builder_cdata(VALUE self, VALUE data) {
     const char    *str;
     const char    *s;
     const char    *end;
+    const char    *from;
+    const char    *split;
+    size_t         extra = 0;
     int            len;
 
     TypedData_Get_Struct(self, struct _builder, &ox_builder_type, b);
 
-    v   = rb_String(v);
-    str = StringValuePtr(v);
-    len = (int)RSTRING_LEN(v);
-    s   = str;
-    end = str + len;
+    v    = rb_String(v);
+    str  = StringValuePtr(v);
+    len  = (int)RSTRING_LEN(v);
+    s    = str;
+    end  = str + len;
+    from = str;
+    check_unescaped(str, (size_t)len);
     i_am_a_child(b, false);
     append_indent(b);
     buf_append_string(&b->buf, "<![CDATA[", 9);
     b->col += 9;
     b->pos += 9;
-    buf_append_string(&b->buf, str, len);
-    b->col += len;
+    // See xml_cdata_end(). The ']]' stays in this section and the '>' opens the
+    // next one, so from lands on the '>' each time round.
+    while (NULL != (split = xml_cdata_end(from, end))) {
+        buf_append_string(&b->buf, from, (split + 2) - from);
+        buf_append_string(&b->buf, "]]><![CDATA[", CDATA_SPLIT_EXTRA);
+        extra += CDATA_SPLIT_EXTRA;
+        from = split + 2;
+    }
+    buf_append_string(&b->buf, from, end - from);
+    b->col += len + extra;
     s = strchr(s, '\n');
     while (NULL != s) {
         b->line++;
         b->col = end - s;
         s      = strchr(s + 1, '\n');
     }
-    b->pos += len;
+    b->pos += len + extra;
     buf_append_string(&b->buf, "]]>", 3);
     b->col += 3;
     b->pos += 3;