migrate is_valid_hash, blessData, property, atom

2 files changed, 34 insertions, 25 deletions

diff --git a/lib/js/urweb.js b/lib/js/urweb.js
index fe47959f..00637172 100644
--- a/lib/js/urweb.js
+++ b/lib/js/urweb.js
@@ -5109,11 +5109,14 @@ function bless(s) {
 
 
 // Attribute name blessing
+var maxCh = chr(127);
 
 function blessData(s) {
-    for (var i = 0; i < s.length; ++i) {
-        var c = s[i];
-        if (!isAlnum(c) && c != '-' && c != '_')
+    var chars = Array.from(s);
+    
+    for (var i = 0; i < chars.length; ++i) {
+        var c = chars[i];
+        if (c > maxCh || (!isAlnum(c) && c != '-' && c != '_'))
             er("Disallowed character in data-* attribute name");
     }
 
@@ -5124,9 +5127,11 @@ function blessData(s) {
 // CSS validation
 
 function atom(s) {
-    for (var i = 0; i < s.length; ++i) {
-        var c = s[i];
-        if (!isAlnum(c) && c != '+' && c != '-' && c != '.' && c != '%' && c != '#')
+    var chars = Array.from(s);
+    
+    for (var i = 0; i < chars.length; ++i) {
+        var c = chars[i];
+        if (c > maxCh || (!isAlnum(c) && c != '+' && c != '-' && c != '.' && c != '%' && c != '#'))
             er("Disallowed character in CSS atom");
     }
 
@@ -5134,10 +5139,12 @@ function atom(s) {
 }
 
 function css_url(s) {
-    for (var i = 0; i < s.length; ++i) {
-        var c = s[i];
-        if (!isAlnum(c) && c != ':' && c != '/' && c != '.' && c != '_' && c != '+'
-            && c != '-' && c != '%' && c != '?' && c != '&' && c != '=' && c != '#')
+    var chars = Array.from(s);
+    
+    for (var i = 0; i < chars.length; ++i) {
+        var c = chars[i];
+        if (c > maxCh || (!isAlnum(c) && c != ':' && c != '/' && c != '.' && c != '_' && c != '+'
+			  && c != '-' && c != '%' && c != '?' && c != '&' && c != '=' && c != '#'))
             er("Disallowed character in CSS URL");
     }
 
@@ -5145,15 +5152,17 @@ function css_url(s) {
 }
 
 function property(s) {
-    if (s.length <= 0)
+    var chars = Array.from(s);
+    
+    if (chars.length <= 0)
         er("Empty CSS property");
 
-    if (!isLower(s[0]) && s[0] != '_')
+    if (chars[0] > maxCh || (!isLower(chars[0]) && chars[0] != '_'))
         er("Bad initial character in CSS property");
 
-    for (var i = 0; i < s.length; ++i) {
-        var c = s[i];
-        if (!isLower(c) && !isDigit(c) && c != '_' && c != '-')
+    for (var i = 0; i < chars.length; ++i) {
+        var c = chars[i];
+        if (c > maxCh || (!isLower(c) && !isDigit(c) && c != '_' && c != '-'))
             er("Disallowed character in CSS property");
     }
 
diff --git a/src/c/urweb.c b/src/c/urweb.c
index e458a706..96e30cec 100644
--- a/src/c/urweb.c
+++ b/src/c/urweb.c
@@ -1975,7 +1975,7 @@ char *uw_Basis_urlifyString(uw_context ctx, uw_Basis_string s) {
 
     if (c == ' ')
       *p++ = '+';
-    else if (isalnum(c))
+    else if (U8_IS_SINGLE(c) && isalnum(c))
       *p++ = c;
     else {
       sprintf(p, ".%02X", c);
@@ -2067,7 +2067,7 @@ uw_unit uw_Basis_urlifyString_w(uw_context ctx, uw_Basis_string s) {
 
     if (c == ' ')
       uw_writec_unsafe(ctx, '+');
-    else if (isalnum(c))
+    else if (U8_IS_SINGLE(c) && isalnum(c))
       uw_writec_unsafe(ctx, c);
     else {
       sprintf(ctx->page.front, ".%02X", c);
@@ -4758,7 +4758,7 @@ uw_Basis_string uw_Basis_atom(uw_context ctx, uw_Basis_string s) {
 
   for (p = s; *p; ++p) {
     char c = *p;
-    if (!U8_IS_SINGLE(c) && !isalnum((int)c) && c != '+' && c != '-' && c != '.' && c != '%' && c != '#')
+    if (!U8_IS_SINGLE(c) || (!isalnum((int)c) && c != '+' && c != '-' && c != '.' && c != '%' && c != '#'))
       uw_error(ctx, FATAL, "Disallowed character in CSS atom");
   }
 
@@ -4770,8 +4770,8 @@ uw_Basis_string uw_Basis_css_url(uw_context ctx, uw_Basis_string s) {
 
   for (p = s; *p; ++p) {
     char c = *p;
-    if (!U8_IS_SINGLE(c) && !isalnum((int)c) && c != ':' && c != '/' && c != '.' && c != '_' && c != '+'
-        && c != '-' && c != '%' && c != '?' && c != '&' && c != '=' && c != '#')
+    if (!U8_IS_SINGLE(c) || (!isalnum((int)c) && c != ':' && c != '/' && c != '.' && c != '_' && c != '+'
+			     && c != '-' && c != '%' && c != '?' && c != '&' && c != '=' && c != '#'))
       uw_error(ctx, FATAL, "Disallowed character in CSS URL");
   }
 
@@ -4784,12 +4784,12 @@ uw_Basis_string uw_Basis_property(uw_context ctx, uw_Basis_string s) {
   if (!*s)
     uw_error(ctx, FATAL, "Empty CSS property");
 
-  if (!islower((int)s[0]) && s[0] != '_')
+  if (!U8_IS_SINGLE(s[0]) || (!islower((int)s[0]) && s[0] != '_'))
     uw_error(ctx, FATAL, "Bad initial character in CSS property");
 
   for (p = s; *p; ++p) {
     char c = *p;
-    if (!U8_IS_SINGLE(c) && !islower((int)c) && !isdigit((int)c) && c != '_' && c != '-')
+    if (!U8_IS_SINGLE(c) || (!islower((int)c) && !isdigit((int)c) && c != '_' && c != '-'))
       uw_error(ctx, FATAL, "Disallowed character in CSS property");
   }
 
@@ -4840,9 +4840,9 @@ uw_Basis_postField *uw_Basis_firstFormField(uw_context ctx, uw_Basis_string s) {
 
 uw_Basis_string uw_Basis_blessData(uw_context ctx, uw_Basis_string s) {
   char *p = s;
-
+  
   for (; *p; ++p)
-    if (!isalnum(*p) && *p != '-' && *p != '_')
+    if (!U8_IS_SINGLE(*p) || (!isalnum(*p) && *p != '-' && *p != '_'))
       uw_error(ctx, FATAL, "Illegal HTML5 data-* attribute: %s", s);
 
   return s;
@@ -5174,7 +5174,7 @@ int strcmp_nullsafe(const char *str1, const char *str2) {
 
 static int is_valid_hash(uw_Basis_string hash) {
   for (; *hash; ++hash)
-    if (!U8_IS_SINGLE(*hash) && !isxdigit(*hash))
+    if (!U8_IS_SINGLE(*hash) || !isxdigit(*hash))
       return 0;
 
   return 1;