1 files changed, 32 insertions, 7 deletions

diff --git a/server.cpp b/server.cpp
index 344f0bc..5e67b5f 100644
--- a/server.cpp
+++ b/server.cpp
@@ -25,8 +25,8 @@ struct Configuration {
 
 struct RequestError : runtime_error {
         RequestError(int status, const string& meldung)
-          : runtime_error(meldung)
-          , status(status)
+            : runtime_error(meldung)
+            , status(status)
         {
         }
 
@@ -37,7 +37,7 @@ atomic_bool quit{ false };
 atomic_bool reload{ false };
 
 void
-handler(int signal)
+signal_handler(int signal)
 {
         if ( signal == SIGINT || signal == SIGTERM ) {
                 quit = true;
@@ -52,7 +52,7 @@ init_signal_handler()
 {
         struct sigaction sa;
         memset(&sa, 0, sizeof sa);
-        sa.sa_handler = handler;
+        sa.sa_handler = signal_handler;
         sa.sa_flags   = 0;
         sigemptyset(&sa.sa_mask);
 
@@ -73,7 +73,30 @@ load_configuration(Configuration& configuration)
 }
 
 void
-handle_request(char** env, const Configuration&, string_view body, ostream& out)
+escape_html(string_view str, ostream& out)
+{
+        for ( auto chr: str ) {
+                switch ( chr ) {
+                case '<':
+                        out << "&lt;";
+                        break;
+                case '>':
+                        out << "&gt;";
+                        break;
+                case '&':
+                        out << "&amp;";
+                        break;
+                case '\"':
+                        out << "&quot;";
+                        break;
+                default:
+                        out << chr;
+                }
+        }
+}
+
+void
+handle_request(char* env[], const Configuration&, string_view body, ostream& out)
 {
         const char* methode = FCGX_GetParam("REQUEST_METHOD", env);
 
@@ -82,8 +105,10 @@ handle_request(char** env, const Configuration&, string_view body, ostream& out)
         out << "<p>Methode: " << (methode ? methode : "?") << ", Body: " << body.size() << " Bytes</p>";
 
         out << "<pre>";
-        for (int i=0; env[i] != NULL; ++i) {
-                out << env[i] << '\n';
+        for ( int i = 0; env[i] != NULL; ++i ) {
+                // Request-Daten dürfen nicht ungefiltert als HTML ausgegeben werden.
+                escape_html(env[i], out);
+                out << '\n';
         }
         out << "</pre>";
 }