Serious problem with the input validation has been fixed by processing

[kiriwrite/.git] / cgi-files / kiriwrite.cgi

diff --git a/cgi-files/kiriwrite.cgi b/cgi-files/kiriwrite.cgi
index 36255f8..3b55b08 100755 (executable)
--- a/cgi-files/kiriwrite.cgi
+++ b/cgi-files/kiriwrite.cgi
@@ -1492,52 +1492,110 @@ sub kiriwrite_variablecheck{
 
                }
 
-               # Check if the string is a valid UTF8 string.
-
-               if ($variable_data =~ m/^(
-                       [\x09\x0A\x0D\x20-\x7E]              # ASCII
-                       | [\xC2-\xDF][\x80-\xBF]             # non-overlong 2-byte
-                       |  \xE0[\xA0-\xBF][\x80-\xBF]        # excluding overlongs
-                       | [\xE1-\xEC\xEE\xEF][\x80-\xBF]{2}  # straight 3-byte
-                       |  \xED[\x80-\x9F][\x80-\xBF]        # excluding surrogates
-                       |  \xF0[\x90-\xBF][\x80-\xBF]{2}     # planes 1-3
-                       | [\xF1-\xF3][\x80-\xBF]{3}          # planes 4-15
-                       |  \xF4[\x80-\x8F][\x80-\xBF]{2}     # plane 16
-               )*$/x){
-
-                       # The UTF-8 string is valid.
-
-               } else {
-
-                       # The UTF-8 string is not valid, check if the no error
-                       # value is set to 1 and return an error if it isn't.
-
-                       if ($variable_noerror eq 1){
-
-                               # The no error value has been set to 1, so return
-                               # a value of 1 (meaning that the UTF-8 string is
-                               # invalid).
-
-                               return 1; 
-
-                       } elsif ($variable_noerror eq 0) {
-
-                               # The no error value has been set to 0, so return
-                               # an error.
-
-                               kiriwrite_error("invalidutf8");
-
+               my $chunk = 0;
+               my $process = 8192;
+               my $length = 0;
+               my $chunkdata = "";
+
+               while ($chunk < $length){
+
+                       $chunkdata = substr($variable_data, $chunk, $process);
+
+                       if ($chunkdata =~ m/\A(
+                               [\x09\x0A\x0D\x20-\x7E]            # ASCII
+                               | [\xC2-\xDF][\x80-\xBF]             # non-overlong 2-byte
+                               |  \xE0[\xA0-\xBF][\x80-\xBF]        # excluding overlongs
+                               | [\xE1-\xEC\xEE\xEF][\x80-\xBF]{2}  # straight 3-byte
+                               |  \xED[\x80-\x9F][\x80-\xBF]        # excluding surrogates
+                               |  \xF0[\x90-\xBF][\x80-\xBF]{2}     # planes 1-3
+                               | [\xF1-\xF3][\x80-\xBF]{3}          # planes 4-15
+                               |  \xF4[\x80-\x8F][\x80-\xBF]{2}     # plane 16
+                       )*\z/x){
+
+                               # The UTF-8 string is valid.
+       
                        } else {
+       
+                               # The UTF-8 string is not valid, check if the no error
+                               # value is set to 1 and return an error if it isn't.
+       
+                               if ($variable_noerror eq 1){
+       
+                                       # The no error value has been set to 1, so return
+                                       # a value of 1 (meaning that the UTF-8 string is
+                                       # invalid).
+       
+                                       return 1; 
+       
+                               } elsif ($variable_noerror eq 0) {
+       
+                                       # The no error value has been set to 0, so return
+                                       # an error.
+       
+                                       kiriwrite_error("invalidutf8");
+       
+                               } else {
+       
+                                       # The no error value is something else other than 0
+                                       # or 1, so return an error.
+       
+                                       kiriwrite_error("invalidoption");
+       
+                               }
+       
+                       }
 
-                               # The no error value is something else other than 0
-                               # or 1, so return an error.
-
-                               kiriwrite_error("invalidoption");
 
-                       }
+                       $chunk = $chunk + $process;
 
                }
 
+#              # Check if the string is a valid UTF8 string.
+# 
+#              if ($variable_data =~ m/^(
+#                      [\x09\x0A\x0D\x20-\x7E]              # ASCII
+#                      | [\xC2-\xDF][\x80-\xBF]             # non-overlong 2-byte
+#                      |  \xE0[\xA0-\xBF][\x80-\xBF]        # excluding overlongs
+#                      | [\xE1-\xEC\xEE\xEF][\x80-\xBF]{2}  # straight 3-byte
+#                      |  \xED[\x80-\x9F][\x80-\xBF]        # excluding surrogates
+#                      |  \xF0[\x90-\xBF][\x80-\xBF]{2}     # planes 1-3
+#                      | [\xF1-\xF3][\x80-\xBF]{3}          # planes 4-15
+#                      |  \xF4[\x80-\x8F][\x80-\xBF]{2}     # plane 16
+#              )*$/x){
+# 
+#                      # The UTF-8 string is valid.
+# 
+#              } else {
+# 
+#                      # The UTF-8 string is not valid, check if the no error
+#                      # value is set to 1 and return an error if it isn't.
+# 
+#                      if ($variable_noerror eq 1){
+# 
+#                              # The no error value has been set to 1, so return
+#                              # a value of 1 (meaning that the UTF-8 string is
+#                              # invalid).
+# 
+#                              return 1; 
+# 
+#                      } elsif ($variable_noerror eq 0) {
+# 
+#                              # The no error value has been set to 0, so return
+#                              # an error.
+# 
+#                              kiriwrite_error("invalidutf8");
+# 
+#                      } else {
+# 
+#                              # The no error value is something else other than 0
+#                              # or 1, so return an error.
+# 
+#                              kiriwrite_error("invalidoption");
+# 
+#                      }
+# 
+#              }
+
                return 0;
 
        } elsif ($variable_type eq "serverprotocol"){