webcit-ng/server/html2html.c

   1 // Output an HTML message, modifying it slightly to make sure it plays nice
   2 // with the rest of our web framework.
   3 //
   4 // Copyright (c) 2005-2022 by the citadel.org team
   5 //
   6 // This program is open source software.  Use, duplication, or
   7 // disclosure is subject to the GNU General Public License v3.
   8
   9 #include "webcit.h"
  10
  11
  12 // Strip surrounding single or double quotes from a string.
  13 void stripquotes(char *s) {
  14         int len;
  15
  16         if (!s) {
  17                 return;
  18         }
  19
  20         len = strlen(s);
  21         if (len < 2) {
  22                 return;
  23         }
  24
  25         if (((s[0] == '\"') && (s[len - 1] == '\"')) || ((s[0] == '\'') && (s[len - 1] == '\''))) {
  26                 s[len - 1] = 0;
  27                 strcpy(s, &s[1]);
  28         }
  29 }
  30
  31
  32 // Check to see if a META tag has overridden the declared MIME character set.
  33 //
  34 // charset              Character set name (left unchanged if we don't do anything)
  35 // meta_http_equiv      Content of the "http-equiv" portion of the META tag
  36 // meta_content         Content of the "content" portion of the META tag
  37 void extract_charset_from_meta(char *charset, char *meta_http_equiv, char *meta_content) {
  38         char *ptr;
  39         char buf[64];
  40
  41         if (!charset) {
  42                 return;
  43         }
  44         if (!meta_http_equiv) {
  45                 return;
  46         }
  47         if (!meta_content) {
  48                 return;
  49         }
  50
  51         if (strcasecmp(meta_http_equiv, "Content-type")) {
  52                 return;
  53         }
  54
  55         ptr = strchr(meta_content, ';');
  56         if (!ptr) {
  57                 return;
  58         }
  59
  60         safestrncpy(buf, ++ptr, sizeof buf);
  61         string_trim(buf);
  62         if (!strncasecmp(buf, "charset=", 8)) {
  63                 strcpy(charset, &buf[8]);
  64
  65                 // The brain-damaged webmail program in Microsoft Exchange declares
  66                 // a charset of "unicode" when they really mean "UTF-8".  GNU iconv
  67                 // treats "unicode" as an alias for "UTF-16" so we have to manually
  68                 // fix this here, otherwise messages generated in Exchange webmail
  69                 // show up as a big pile of weird characters.
  70                 if (!strcasecmp(charset, "unicode")) {
  71                         strcpy(charset, "UTF-8");
  72                 }
  73
  74                 // Remove wandering punctuation
  75                 if ((ptr = strchr(charset, '\"'))) {
  76                         *ptr = 0;
  77                 }
  78                 string_trim(charset);
  79         }
  80 }
  81
  82
  83 // Sanitize and enhance an HTML message for display.
  84 // Also convert weird character sets to UTF-8 if necessary.
  85 // Also fixup img src="cid:..." type inline images to fetch the image
  86 StrBuf *html2html(const char *supplied_charset, int treat_as_wiki, char *roomname, long msgnum, StrBuf *Source) {
  87         char buf[SIZ];
  88         char *msg;
  89         char *ptr;
  90         char *msgstart;
  91         char *msgend;
  92         StrBuf *converted_msg;
  93         int buffer_length = 1;
  94         int line_length = 0;
  95         int content_length = 0;
  96         char new_window[SIZ];
  97         int brak = 0;
  98         int alevel = 0;
  99         int scriptlevel = 0;
 100         int script_start_pos = (-1);
 101         int i;
 102         int linklen;
 103         char charset[128];
 104         StrBuf *BodyArea = NULL;
 105
 106         iconv_t ic = (iconv_t) (-1);
 107         char *ibuf;             // Buffer of characters to be converted
 108         char *obuf;             // Buffer for converted characters
 109         size_t ibuflen;         // Length of input buffer
 110         size_t obuflen;         // Length of output buffer
 111         char *osav;             // Saved pointer to output buffer
 112
 113         StrBuf *Target = NewStrBuf();
 114         if (Target == NULL) {
 115                 return (NULL);
 116         }
 117
 118         safestrncpy(charset, supplied_charset, sizeof charset);
 119         sprintf(new_window, "<a target=\"%s\" href=", TARGET);
 120
 121         content_length = StrLength(Source);
 122         msg = (char *) ChrPtr(Source);
 123         buffer_length = content_length;
 124
 125         // Do a first pass to isolate the message body
 126         ptr = msg + 1;
 127         msgstart = msg;
 128         msgend = &msg[content_length];
 129
 130         while (ptr < msgend) {
 131
 132                 // Advance to next tag
 133                 ptr = strchr(ptr, '<');
 134                 if ((ptr == NULL) || (ptr >= msgend))
 135                         break;
 136                 ++ptr;
 137                 if ((ptr == NULL) || (ptr >= msgend))
 138                         break;
 139
 140                 //  Look for META tags.  Some messages (particularly in
 141                 //  Asian locales) illegally declare a message's character
 142                 //  set in the HTML instead of in the MIME headers.  This
 143                 //  is wrong but we have to work around it anyway.
 144                 if (!strncasecmp(ptr, "META", 4)) {
 145
 146                         char *meta_start;
 147                         char *meta_end;
 148                         int meta_length;
 149                         char *meta;
 150                         char *meta_http_equiv;
 151                         char *meta_content;
 152                         char *spaceptr;
 153
 154                         meta_start = &ptr[4];
 155                         meta_end = strchr(ptr, '>');
 156                         if ((meta_end != NULL) && (meta_end <= msgend)) {
 157                                 meta_length = meta_end - meta_start + 1;
 158                                 meta = malloc(meta_length + 1);
 159                                 safestrncpy(meta, meta_start, meta_length);
 160                                 meta[meta_length] = 0;
 161                                 string_trim(meta);
 162                                 if (!strncasecmp(meta, "HTTP-EQUIV=", 11)) {
 163                                         meta_http_equiv = strdup(&meta[11]);
 164                                         spaceptr = strchr(meta_http_equiv, ' ');
 165                                         if (spaceptr != NULL) {
 166                                                 *spaceptr = 0;
 167                                                 meta_content = strdup(++spaceptr);
 168                                                 if (!strncasecmp(meta_content, "content=", 8)) {
 169                                                         strcpy(meta_content, &meta_content[8]);
 170                                                         stripquotes(meta_http_equiv);
 171                                                         stripquotes(meta_content);
 172                                                         extract_charset_from_meta(charset, meta_http_equiv, meta_content);
 173                                                 }
 174                                                 free(meta_content);
 175                                         }
 176                                         free(meta_http_equiv);
 177                                 }
 178                                 free(meta);
 179                         }
 180                 }
 181
 182                 // Any of these tags cause everything up to and including
 183                 // the tag to be removed.
 184                 if ((!strncasecmp(ptr, "HTML", 4))
 185                     || (!strncasecmp(ptr, "HEAD", 4))
 186                     || (!strncasecmp(ptr, "/HEAD", 5))
 187                     || (!strncasecmp(ptr, "BODY", 4))) {
 188                         char *pBody = NULL;
 189
 190                         if (!strncasecmp(ptr, "BODY", 4)) {
 191                                 pBody = ptr;
 192                         }
 193                         ptr = strchr(ptr, '>');
 194                         if ((ptr == NULL) || (ptr >= msgend))
 195                                 break;
 196                         if ((pBody != NULL) && (ptr - pBody > 4)) {
 197                                 char *src;
 198                                 char *cid_start, *cid_end;
 199
 200                                 *ptr = '\0';
 201                                 pBody += 4;
 202                                 while ((isspace(*pBody)) && (pBody < ptr))
 203                                         pBody++;
 204                                 BodyArea = NewStrBufPlain(NULL, ptr - pBody);
 205
 206                                 if (pBody < ptr) {
 207                                         src = strstr(pBody, "cid:");
 208                                         if (src) {
 209                                                 cid_start = src + 4;
 210                                                 cid_end = cid_start;
 211                                                 while ((*cid_end != '"') && !isspace(*cid_end) && (cid_end < ptr))
 212                                                         cid_end++;
 213
 214                                                 // copy tag and attributes up to src="cid:
 215                                                 StrBufAppendBufPlain(BodyArea, pBody, src - pBody, 0);
 216
 217                                                 // add in /webcit/mimepart/<msgno>/CID/
 218                                                 // trailing / stops dumb URL filters getting excited
 219                                                 StrBufAppendPrintf(BodyArea, "/webcit/mimepart/%ld/", msgnum);
 220                                                 StrBufAppendBufPlain(BodyArea, cid_start, cid_end - cid_start, 0);
 221
 222                                                 if (ptr - cid_end > 0)
 223                                                         StrBufAppendBufPlain(BodyArea, cid_end + 1, ptr - cid_end, 0);
 224                                         }
 225                                         else {
 226                                                 StrBufAppendBufPlain(BodyArea, pBody, ptr - pBody, 0);
 227                                         }
 228                                 }
 229                                 *ptr = '>';
 230                         }
 231                         ++ptr;
 232                         if ((ptr == NULL) || (ptr >= msgend))
 233                                 break;
 234                         msgstart = ptr;
 235                 }
 236
 237                 // Any of these tags cause everything including and following
 238                 // the tag to be removed.
 239                 if ((!strncasecmp(ptr, "/HTML", 5)) || (!strncasecmp(ptr, "/BODY", 5))) {
 240                         --ptr;
 241                         msgend = ptr;
 242                         strcpy(ptr, "");
 243                 }
 244
 245                 ++ptr;
 246         }
 247         if (msgstart > msg) {
 248                 strcpy(msg, msgstart);
 249         }
 250
 251         // Now go through the message, parsing tags as necessary.
 252         converted_msg = NewStrBufPlain(NULL, content_length + 8192);
 253
 254         // Convert foreign character sets to UTF-8 if necessary
 255         if ((strcasecmp(charset, "us-ascii"))
 256             && (strcasecmp(charset, "UTF-8"))
 257             && (strcasecmp(charset, ""))
 258             ) {
 259                 syslog(LOG_DEBUG, "Converting %s to UTF-8", charset);
 260                 ctdl_iconv_open("UTF-8", charset, &ic);
 261                 if (ic == (iconv_t) (-1)) {
 262                         syslog(LOG_WARNING, "%s:%d iconv_open() failed: %s", __FILE__, __LINE__, strerror(errno));
 263                 }
 264         }
 265         if (Source == NULL) {
 266                 if (ic != (iconv_t) (-1)) {
 267                         ibuf = msg;
 268                         ibuflen = content_length;
 269                         obuflen = content_length + (content_length / 2);
 270                         obuf = (char *) malloc(obuflen);
 271                         osav = obuf;
 272                         iconv(ic, &ibuf, &ibuflen, &obuf, &obuflen);
 273                         content_length = content_length + (content_length / 2) - obuflen;
 274                         osav[content_length] = 0;
 275                         free(msg);
 276                         msg = osav;
 277                         iconv_close(ic);
 278                 }
 279         }
 280         else {
 281                 if (ic != (iconv_t) (-1)) {
 282                         StrBuf *Buf = NewStrBufPlain(NULL, StrLength(Source) + 8096);;
 283                         StrBufConvert(Source, Buf, &ic);
 284                         FreeStrBuf(&Buf);
 285                         iconv_close(ic);
 286                         msg = (char *) ChrPtr(Source);  // TODO: get rid of this.
 287                 }
 288         }
 289
 290         // At this point, the message has been stripped down to
 291         // only the content inside the <BODY></BODY> tags, and has
 292         // been converted to UTF-8 if it was originally in a foreign
 293         // character set.  The text is also guaranteed to be null
 294         // terminated now.
 295
 296         if (converted_msg == NULL) {
 297                 StrBufAppendPrintf(Target, "Error %d: %s<br>%s:%d", errno, strerror(errno), __FILE__, __LINE__);
 298                 goto BAIL;
 299         }
 300
 301         if (BodyArea != NULL) { // Any attributes that were declared in the <body> tag
 302                 StrBufAppendBufPlain(converted_msg, HKEY("<div "), 0);  // are instead declared in this <div> tag
 303                 StrBufAppendBuf(converted_msg, BodyArea, 0);
 304                 StrBufAppendBufPlain(converted_msg, HKEY(">"), 0);
 305         }
 306         ptr = msg;
 307         msgend = strchr(msg, 0);
 308         while (ptr < msgend) {
 309
 310                 // Try to sanitize the html of any rogue scripts
 311                 if (!strncasecmp(ptr, "<script", 7)) {
 312                         if (scriptlevel == 0) {
 313                                 script_start_pos = StrLength(converted_msg);
 314                         }
 315                         ++scriptlevel;
 316                 }
 317                 if (!strncasecmp(ptr, "</script", 8)) {
 318                         --scriptlevel;
 319                 }
 320
 321                 // Change mailto: links to WebCit mail, by replacing the
 322                 // link with one that points back to our mail room.  Due to
 323                 // the way we parse URL's, it'll even handle mailto: links
 324                 // that have "?subject=" in them.
 325                 // FIXME change URL syntax for webcit-ng
 326                 if (!strncasecmp(ptr, "<a href=\"mailto:", 16)) {
 327                         content_length += 64;
 328                         StrBufAppendPrintf(converted_msg, "<a href=\"display_enter?force_room=_MAIL_?recp=");
 329                         ptr = &ptr[16];
 330                         ++alevel;
 331                         ++brak;
 332                 }
 333
 334                 // Make external links open in a separate window
 335                 else if (!strncasecmp(ptr, "<a href=\"", 9)) {
 336                         ++alevel;
 337                         ++brak;
 338                         if (((strchr(ptr, ':') < strchr(ptr, '/'))) && ((strchr(ptr, '/') < strchr(ptr, '>')))) {
 339                                 // open external links to new window
 340                                 StrBufAppendPrintf(converted_msg, new_window);
 341                                 ptr = &ptr[8];
 342                         }
 343                         else if ((treat_as_wiki)
 344                                    && (strncasecmp(ptr, "<a href=\"wiki?", 14))
 345                                    && (strncasecmp(ptr, "<a href=\"dotgoto?", 17))
 346                                    && (strncasecmp(ptr, "<a href=\"knrooms?", 17))
 347                             ) {
 348                                 content_length += 64;
 349                                 StrBufAppendPrintf(converted_msg, "<a href=\"wiki?go=");
 350                                 //StrBufUrlescAppend(converted_msg, "FIXME ROOM NAME", NULL);                   // FIXME make compatible with webcit-ng
 351                                 StrBufAppendPrintf(converted_msg, "?page=");
 352                                 ptr = &ptr[9];
 353                         }
 354                         else {
 355                                 StrBufAppendPrintf(converted_msg, "<a href=\"");
 356                                 ptr = &ptr[9];
 357                         }
 358                 }
 359
 360                 // Fixup <img src="cid:... ...> to fetch the mime part
 361                 else if (!strncasecmp(ptr, "<img ", 5)) {
 362                         char *cid_start, *cid_end;
 363                         char *tag_end = strchr(ptr, '>');
 364                         char *src;
 365                         // FIXME - handle this situation (maybe someone opened an <img cid...
 366                         // and then ended the message)
 367                         if (!tag_end) {
 368                                 syslog(LOG_DEBUG, "tag_end is null and ptr is:");
 369                                 syslog(LOG_DEBUG, "%s", ptr);
 370                                 syslog(LOG_DEBUG, "Theoretical bytes remaining: %d", (int) (msgend - ptr));
 371                         }
 372
 373                         src = strstr(ptr, "src=\"cid:");
 374                         ++brak;
 375
 376                         if (src && isspace(*(src - 1))
 377                             && tag_end && (cid_start = strchr(src, ':'))
 378                             && (cid_end = strchr(cid_start, '"'))
 379                             && (cid_end < tag_end)
 380                             ) {
 381                                 // copy tag and attributes up to src="cid:
 382                                 StrBufAppendBufPlain(converted_msg, ptr, src - ptr, 0);
 383                                 cid_start++;
 384
 385                                 // add in /webcit/mimepart/<msgnum>/CID/
 386                                 // trailing / stops dumb URL filters getting excited
 387                                 StrBufAppendPrintf(converted_msg, " src=\"/ctdl/r/");
 388                                 StrBufXMLEscAppend(converted_msg, NULL, roomname, strlen(roomname), 0);
 389                                 syslog(LOG_DEBUG, "room name is '%s'", roomname);
 390                                 StrBufAppendPrintf(converted_msg, "/%ld/", msgnum);
 391                                 StrBufAppendBufPlain(converted_msg, cid_start, cid_end - cid_start, 0);
 392                                 StrBufAppendBufPlain(converted_msg, "\"", -1, 0);
 393                                 ptr = cid_end + 1;
 394                         }
 395                         StrBufAppendBufPlain(converted_msg, ptr, tag_end - ptr, 0);
 396                         ptr = tag_end;
 397                 }
 398
 399                 // Turn anything that looks like a URL into a real link, as long
 400                 // as it's not inside a tag already
 401                 else if ((brak == 0) && (alevel == 0) && ((!strncasecmp(ptr, "http://", 7)) || (!strncasecmp(ptr, "https://", 8)))) {
 402                         // Find the end of the link
 403                         int strlenptr;
 404                         linklen = 0;
 405
 406                         strlenptr = strlen(ptr);
 407                         for (i = 0; i <= strlenptr; ++i) {
 408                                 if ((ptr[i] == 0)
 409                                     || (isspace(ptr[i]))
 410                                     || (ptr[i] == 10)
 411                                     || (ptr[i] == 13)
 412                                     || (ptr[i] == '(')
 413                                     || (ptr[i] == ')')
 414                                     || (ptr[i] == '<')
 415                                     || (ptr[i] == '>')
 416                                     || (ptr[i] == '[')
 417                                     || (ptr[i] == ']')
 418                                     || (ptr[i] == '"')
 419                                     || (ptr[i] == '\'')
 420                                     )
 421                                         linklen = i;
 422                                 // entity tag?
 423                                 if (ptr[i] == '&') {
 424                                         if ((ptr[i + 2] == ';') ||
 425                                             (ptr[i + 3] == ';') ||
 426                                             (ptr[i + 5] == ';') || (ptr[i + 6] == ';') || (ptr[i + 7] == ';'))
 427                                                 linklen = i;
 428                                 }
 429                                 if (linklen > 0)
 430                                         break;
 431                         }
 432                         if (linklen > 0) {
 433                                 char *ltreviewptr;
 434                                 char *nbspreviewptr;
 435                                 char linkedchar;
 436                                 int len;
 437
 438                                 len = linklen;
 439                                 linkedchar = ptr[len];
 440                                 ptr[len] = '\0';
 441                                 // spot for some subject strings tinymce tends to give us.
 442                                 ltreviewptr = strchr(ptr, '<');
 443                                 if (ltreviewptr != NULL) {
 444                                         *ltreviewptr = '\0';
 445                                         linklen = ltreviewptr - ptr;
 446                                 }
 447
 448                                 nbspreviewptr = strstr(ptr, "&nbsp;");
 449                                 if (nbspreviewptr != NULL) {
 450                                         // nbspreviewptr = '\0';
 451                                         linklen = nbspreviewptr - ptr;
 452                                 }
 453                                 if (ltreviewptr != 0)
 454                                         *ltreviewptr = '<';
 455
 456                                 ptr[len] = linkedchar;
 457
 458                                 content_length += (32 + linklen);
 459                                 StrBufAppendPrintf(converted_msg, "%s\"", new_window);
 460                                 StrBufAppendBufPlain(converted_msg, ptr, linklen, 0);
 461                                 StrBufAppendPrintf(converted_msg, "\">");
 462                                 StrBufAppendBufPlain(converted_msg, ptr, linklen, 0);
 463                                 ptr += linklen;
 464                                 StrBufAppendPrintf(converted_msg, "</a>");
 465                         }
 466                 }
 467                 else {
 468                         StrBufAppendBufPlain(converted_msg, ptr, 1, 0);
 469                         ptr++;
 470                 }
 471
 472                 if ((ptr >= msg) && (ptr <= msgend)) {
 473                         // We need to know when we're inside a tag,
 474                         // so we don't turn things that look like URL's into
 475                         // links, when they're already links - or image sources.
 476                         if ((ptr > msg) && (*(ptr - 1) == '<')) {
 477                                 ++brak;
 478                         }
 479                         if ((ptr > msg) && (*(ptr - 1) == '>')) {
 480                                 --brak;
 481                                 if ((scriptlevel == 0) && (script_start_pos >= 0)) {
 482                                         StrBufCutRight(converted_msg, StrLength(converted_msg) - script_start_pos);
 483                                         script_start_pos = (-1);
 484                                 }
 485                         }
 486                         if (!strncasecmp(ptr, "</a>", 3))
 487                                 --alevel;
 488                 }
 489         }
 490
 491         if (BodyArea != NULL) {
 492                 StrBufAppendBufPlain(converted_msg, HKEY("</div>"), 0); // Close the div where we declared attributes copied
 493                 FreeStrBuf(&BodyArea);  // from the original <body> tag
 494         }
 495
 496         //      uncomment these two lines to override conversion
 497         //      memcpy(converted_msg, msg, content_length);
 498         //      output_length = content_length;
 499
 500         // Output our big pile of markup
 501         StrBufAppendBuf(Target, converted_msg, 0);
 502
 503       BAIL:                     // A little trailing vertical whitespace...
 504         StrBufAppendPrintf(Target, "<br>\n");
 505
 506         // Now give back the memory
 507         FreeStrBuf(&converted_msg);
 508         if ((msg != NULL) && (Source == NULL))
 509                 free(msg);
 510         return (Target);
 511 }
 512
 513
 514 // Look for URL's embedded in a buffer and make them linkable.  We use a
 515 // target window in order to keep the Citadel session in its own window.
 516 void UrlizeText(StrBuf * Target, StrBuf * Source, StrBuf * WrkBuf) {
 517         int len, UrlLen, Offset, TrailerLen;
 518         const char *start, *end, *pos;
 519
 520         FlushStrBuf(Target);
 521         start = NULL;
 522         len = StrLength(Source);
 523         end = ChrPtr(Source) + len;
 524         for (pos = ChrPtr(Source); (pos < end) && (start == NULL); ++pos) {
 525                 if (!strncasecmp(pos, "http://", 7))
 526                         start = pos;
 527                 else if (!strncasecmp(pos, "ftp://", 6))
 528                         start = pos;
 529         }
 530
 531         if (start == NULL) {
 532                 StrBufAppendBuf(Target, Source, 0);
 533                 return;
 534         }
 535         FlushStrBuf(WrkBuf);
 536
 537         for (pos = ChrPtr(Source) + len; pos > start; --pos) {
 538                 if ((!isprint(*pos))
 539                     || (isspace(*pos))
 540                     || (*pos == '{')
 541                     || (*pos == '}')
 542                     || (*pos == '|')
 543                     || (*pos == '\\')
 544                     || (*pos == '^')
 545                     || (*pos == '[')
 546                     || (*pos == ']')
 547                     || (*pos == '`')
 548                     || (*pos == '<')
 549                     || (*pos == '>')
 550                     || (*pos == '(')
 551                     || (*pos == ')')
 552                     ) {
 553                         end = pos;
 554                 }
 555         }
 556
 557         UrlLen = end - start;
 558         StrBufAppendBufPlain(WrkBuf, start, UrlLen, 0);
 559
 560         Offset = start - ChrPtr(Source);
 561         if (Offset != 0)
 562                 StrBufAppendBufPlain(Target, ChrPtr(Source), Offset, 0);
 563         StrBufAppendPrintf(Target, "%ca href=%c%s%c TARGET=%c%s%c%c%s%c/A%c",
 564                            LB, QU, ChrPtr(WrkBuf), QU, QU, TARGET, QU, RB, ChrPtr(WrkBuf), LB, RB);
 565
 566         TrailerLen = StrLength(Source) - (end - ChrPtr(Source));
 567         if (TrailerLen > 0)
 568                 StrBufAppendBufPlain(Target, end, TrailerLen, 0);
 569 }
 570
 571
 572 void url(char *buf, size_t bufsize) {
 573         int len, UrlLen, Offset, TrailerLen, outpos;
 574         char *start, *end, *pos;
 575         char urlbuf[SIZ];
 576         char outbuf[SIZ];
 577
 578         start = NULL;
 579         len = strlen(buf);
 580         if (len > bufsize) {
 581                 syslog(LOG_WARNING, "URL: content longer than buffer!");
 582                 return;
 583         }
 584         end = buf + len;
 585         for (pos = buf; (pos < end) && (start == NULL); ++pos) {
 586                 if (!strncasecmp(pos, "http://", 7))
 587                         start = pos;
 588                 if (!strncasecmp(pos, "ftp://", 6))
 589                         start = pos;
 590         }
 591
 592         if (start == NULL)
 593                 return;
 594
 595         for (pos = buf + len; pos > start; --pos) {
 596                 if ((!isprint(*pos))
 597                     || (isspace(*pos))
 598                     || (*pos == '{')
 599                     || (*pos == '}')
 600                     || (*pos == '|')
 601                     || (*pos == '\\')
 602                     || (*pos == '^')
 603                     || (*pos == '[')
 604                     || (*pos == ']')
 605                     || (*pos == '`')
 606                     || (*pos == '<')
 607                     || (*pos == '>')
 608                     || (*pos == '(')
 609                     || (*pos == ')')
 610                     ) {
 611                         end = pos;
 612                 }
 613         }
 614
 615         UrlLen = end - start;
 616         if (UrlLen > sizeof(urlbuf)) {
 617                 syslog(LOG_WARNING, "URL: content longer than buffer!");
 618                 return;
 619         }
 620         memcpy(urlbuf, start, UrlLen);
 621         urlbuf[UrlLen] = '\0';
 622
 623         Offset = start - buf;
 624         if ((Offset != 0) && (Offset < sizeof(outbuf)))
 625                 memcpy(outbuf, buf, Offset);
 626         outpos = snprintf(&outbuf[Offset], sizeof(outbuf) - Offset,
 627                           "%ca href=%c%s%c TARGET=%c%s%c%c%s%c/A%c", LB, QU, urlbuf, QU, QU, TARGET, QU, RB, urlbuf, LB, RB);
 628         if (outpos >= sizeof(outbuf) - Offset) {
 629                 syslog(LOG_WARNING, "URL: content longer than buffer!");
 630                 return;
 631         }
 632
 633         TrailerLen = len - (end - start);
 634         if (TrailerLen > 0)
 635                 memcpy(outbuf + Offset + outpos, end, TrailerLen);
 636         if (Offset + outpos + TrailerLen > bufsize) {
 637                 syslog(LOG_WARNING, "URL: content longer than buffer!");
 638                 return;
 639         }
 640         memcpy(buf, outbuf, Offset + outpos + TrailerLen);
 641         *(buf + Offset + outpos + TrailerLen) = '\0';
 642 }