From 2ac83ca7e7fc75c51e550720ed89dfe4097b1df4 Mon Sep 17 00:00:00 2001
From: Thomas Schmucker <ts@its1.de>
Date: Mon, 21 Sep 2026 09:28:52 +0200
Subject: neue Funktion: escape_html()

---
 server.cpp | 39 ++++++++++++++++++++++++++++++++-------
 1 file changed, 32 insertions(+), 7 deletions(-)

diff --git a/server.cpp b/server.cpp
index 344f0bc..5e67b5f 100644
--- a/server.cpp
+++ b/server.cpp
@@ -25,8 +25,8 @@ struct Configuration {
 
 struct RequestError : runtime_error {
 	RequestError(int status, const string& meldung)
-	  : runtime_error(meldung)
-	  , status(status)
+	    : runtime_error(meldung)
+	    , status(status)
 	{
 	}
 
@@ -37,7 +37,7 @@ atomic_bool quit{ false };
 atomic_bool reload{ false };
 
 void
-handler(int signal)
+signal_handler(int signal)
 {
 	if ( signal == SIGINT || signal == SIGTERM ) {
 		quit = true;
@@ -52,7 +52,7 @@ init_signal_handler()
 {
 	struct sigaction sa;
 	memset(&sa, 0, sizeof sa);
-	sa.sa_handler = handler;
+	sa.sa_handler = signal_handler;
 	sa.sa_flags   = 0;
 	sigemptyset(&sa.sa_mask);
 
@@ -73,7 +73,30 @@ load_configuration(Configuration& configuration)
 }
 
 void
-handle_request(char** env, const Configuration&, string_view body, ostream& out)
+escape_html(string_view str, ostream& out)
+{
+	for ( auto chr: str ) {
+		switch ( chr ) {
+		case '<':
+			out << "&lt;";
+			break;
+		case '>':
+			out << "&gt;";
+			break;
+		case '&':
+			out << "&amp;";
+			break;
+		case '\"':
+			out << "&quot;";
+			break;
+		default:
+			out << chr;
+		}
+	}
+}
+
+void
+handle_request(char* env[], const Configuration&, string_view body, ostream& out)
 {
 	const char* methode = FCGX_GetParam("REQUEST_METHOD", env);
 
@@ -82,8 +105,10 @@ handle_request(char** env, const Configuration&, string_view body, ostream& out)
 	out << "<p>Methode: " << (methode ? methode : "?") << ", Body: " << body.size() << " Bytes</p>";
 
 	out << "<pre>";
-	for (int i=0; env[i] != NULL; ++i) {
-		out << env[i] << '\n';
+	for ( int i = 0; env[i] != NULL; ++i ) {
+		// Request-Daten dürfen nicht ungefiltert als HTML ausgegeben werden.
+		escape_html(env[i], out);
+		out << '\n';
 	}
 	out << "</pre>";
 }
-- 
cgit v1.3