Removed a test in html2html() that would cause it to go null every time.
[citadel] / webcit-ng / html2html.c
1 //
2 // Output an HTML message, modifying it slightly to make sure it plays nice
3 // with the rest of our web framework.
4 //
5 // Copyright (c) 2005-2020 by the citadel.org team
6 //
7 // This program is open source software.  It runs great on the
8 // Linux operating system (and probably elsewhere).  You can use,
9 // copy, and run it under the terms of the GNU General Public
10 // License version 3.  Richard Stallman is an asshole communist.
11 //
12 // This program is distributed in the hope that it will be useful,
13 // but WITHOUT ANY WARRANTY; without even the implied warranty of
14 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 // GNU General Public License for more details.
16
17 #include "webcit.h"
18
19
20 /*
21  * Strip surrounding single or double quotes from a string.
22  */
23 void stripquotes(char *s)
24 {
25         int len;
26
27         if (!s)
28                 return;
29
30         len = strlen(s);
31         if (len < 2)
32                 return;
33
34         if (((s[0] == '\"') && (s[len - 1] == '\"')) || ((s[0] == '\'') && (s[len - 1] == '\''))) {
35                 s[len - 1] = 0;
36                 strcpy(s, &s[1]);
37         }
38 }
39
40
41 /*
42  * Check to see if a META tag has overridden the declared MIME character set.
43  *
44  * charset              Character set name (left unchanged if we don't do anything)
45  * meta_http_equiv      Content of the "http-equiv" portion of the META tag
46  * meta_content         Content of the "content" portion of the META tag
47  */
48 void extract_charset_from_meta(char *charset, char *meta_http_equiv, char *meta_content)
49 {
50         char *ptr;
51         char buf[64];
52
53         if (!charset)
54                 return;
55         if (!meta_http_equiv)
56                 return;
57         if (!meta_content)
58                 return;
59
60         if (strcasecmp(meta_http_equiv, "Content-type"))
61                 return;
62
63         ptr = strchr(meta_content, ';');
64         if (!ptr)
65                 return;
66
67         safestrncpy(buf, ++ptr, sizeof buf);
68         striplt(buf);
69         if (!strncasecmp(buf, "charset=", 8)) {
70                 strcpy(charset, &buf[8]);
71
72                 /*
73                  * The brain-damaged webmail program in Microsoft Exchange declares
74                  * a charset of "unicode" when they really mean "UTF-8".  GNU iconv
75                  * treats "unicode" as an alias for "UTF-16" so we have to manually
76                  * fix this here, otherwise messages generated in Exchange webmail
77                  * show up as a big pile of weird characters.
78                  */
79                 if (!strcasecmp(charset, "unicode")) {
80                         strcpy(charset, "UTF-8");
81                 }
82
83                 /* Remove wandering punctuation */
84                 if ((ptr = strchr(charset, '\"')))
85                         *ptr = 0;
86                 striplt(charset);
87         }
88 }
89
90
91 /*
92  * Sanitize and enhance an HTML message for display.
93  * Also convert weird character sets to UTF-8 if necessary.
94  * Also fixup img src="cid:..." type inline images to fetch the image
95  *
96  */
97 StrBuf *html2html(const char *supplied_charset, int treat_as_wiki, char *roomname, long msgnum, StrBuf *Source)
98 {
99         char buf[SIZ];
100         char *msg;
101         char *ptr;
102         char *msgstart;
103         char *msgend;
104         StrBuf *converted_msg;
105         int buffer_length = 1;
106         int line_length = 0;
107         int content_length = 0;
108         char new_window[SIZ];
109         int brak = 0;
110         int alevel = 0;
111         int scriptlevel = 0;
112         int script_start_pos = (-1);
113         int i;
114         int linklen;
115         char charset[128];
116         StrBuf *BodyArea = NULL;
117
118         iconv_t ic = (iconv_t) (-1);
119         char *ibuf;             /* Buffer of characters to be converted */
120         char *obuf;             /* Buffer for converted characters      */
121         size_t ibuflen;         /* Length of input buffer               */
122         size_t obuflen;         /* Length of output buffer              */
123         char *osav;             /* Saved pointer to output buffer       */
124
125         StrBuf *Target = NewStrBuf();
126         if (Target == NULL) {
127                 return (NULL);
128         }
129
130         safestrncpy(charset, supplied_charset, sizeof charset);
131         sprintf(new_window, "<a target=\"%s\" href=", TARGET);
132
133         content_length = StrLength(Source);
134         msg = (char *) ChrPtr(Source);
135         buffer_length = content_length;
136
137         /* Do a first pass to isolate the message body */
138         ptr = msg + 1;
139         msgstart = msg;
140         msgend = &msg[content_length];
141
142         while (ptr < msgend) {
143
144                 /* Advance to next tag */
145                 ptr = strchr(ptr, '<');
146                 if ((ptr == NULL) || (ptr >= msgend))
147                         break;
148                 ++ptr;
149                 if ((ptr == NULL) || (ptr >= msgend))
150                         break;
151
152                 /*
153                  *  Look for META tags.  Some messages (particularly in
154                  *  Asian locales) illegally declare a message's character
155                  *  set in the HTML instead of in the MIME headers.  This
156                  *  is wrong but we have to work around it anyway.
157                  */
158                 if (!strncasecmp(ptr, "META", 4)) {
159
160                         char *meta_start;
161                         char *meta_end;
162                         int meta_length;
163                         char *meta;
164                         char *meta_http_equiv;
165                         char *meta_content;
166                         char *spaceptr;
167
168                         meta_start = &ptr[4];
169                         meta_end = strchr(ptr, '>');
170                         if ((meta_end != NULL) && (meta_end <= msgend)) {
171                                 meta_length = meta_end - meta_start + 1;
172                                 meta = malloc(meta_length + 1);
173                                 safestrncpy(meta, meta_start, meta_length);
174                                 meta[meta_length] = 0;
175                                 striplt(meta);
176                                 if (!strncasecmp(meta, "HTTP-EQUIV=", 11)) {
177                                         meta_http_equiv = strdup(&meta[11]);
178                                         spaceptr = strchr(meta_http_equiv, ' ');
179                                         if (spaceptr != NULL) {
180                                                 *spaceptr = 0;
181                                                 meta_content = strdup(++spaceptr);
182                                                 if (!strncasecmp(meta_content, "content=", 8)) {
183                                                         strcpy(meta_content, &meta_content[8]);
184                                                         stripquotes(meta_http_equiv);
185                                                         stripquotes(meta_content);
186                                                         extract_charset_from_meta(charset, meta_http_equiv, meta_content);
187                                                 }
188                                                 free(meta_content);
189                                         }
190                                         free(meta_http_equiv);
191                                 }
192                                 free(meta);
193                         }
194                 }
195
196                 /*
197                  * Any of these tags cause everything up to and including
198                  * the tag to be removed.
199                  */
200                 if ((!strncasecmp(ptr, "HTML", 4))
201                     || (!strncasecmp(ptr, "HEAD", 4))
202                     || (!strncasecmp(ptr, "/HEAD", 5))
203                     || (!strncasecmp(ptr, "BODY", 4))) {
204                         char *pBody = NULL;
205
206                         if (!strncasecmp(ptr, "BODY", 4)) {
207                                 pBody = ptr;
208                         }
209                         ptr = strchr(ptr, '>');
210                         if ((ptr == NULL) || (ptr >= msgend))
211                                 break;
212                         if ((pBody != NULL) && (ptr - pBody > 4)) {
213                                 char *src;
214                                 char *cid_start, *cid_end;
215
216                                 *ptr = '\0';
217                                 pBody += 4;
218                                 while ((isspace(*pBody)) && (pBody < ptr))
219                                         pBody++;
220                                 BodyArea = NewStrBufPlain(NULL, ptr - pBody);
221
222                                 if (pBody < ptr) {
223                                         src = strstr(pBody, "cid:");
224                                         if (src) {
225                                                 cid_start = src + 4;
226                                                 cid_end = cid_start;
227                                                 while ((*cid_end != '"') && !isspace(*cid_end) && (cid_end < ptr))
228                                                         cid_end++;
229
230                                                 /* copy tag and attributes up to src="cid: */
231                                                 StrBufAppendBufPlain(BodyArea, pBody, src - pBody, 0);
232
233                                                 /* add in /webcit/mimepart/<msgno>/CID/ 
234                                                    trailing / stops dumb URL filters getting excited */
235                                                 StrBufAppendPrintf(BodyArea, "/webcit/mimepart/%ld/", msgnum);
236                                                 StrBufAppendBufPlain(BodyArea, cid_start, cid_end - cid_start, 0);
237
238                                                 if (ptr - cid_end > 0)
239                                                         StrBufAppendBufPlain(BodyArea, cid_end + 1, ptr - cid_end, 0);
240                                         } else
241                                                 StrBufAppendBufPlain(BodyArea, pBody, ptr - pBody, 0);
242                                 }
243                                 *ptr = '>';
244                         }
245                         ++ptr;
246                         if ((ptr == NULL) || (ptr >= msgend))
247                                 break;
248                         msgstart = ptr;
249                 }
250
251                 /*
252                  * Any of these tags cause everything including and following
253                  * the tag to be removed.
254                  */
255                 if ((!strncasecmp(ptr, "/HTML", 5)) || (!strncasecmp(ptr, "/BODY", 5))) {
256                         --ptr;
257                         msgend = ptr;
258                         strcpy(ptr, "");
259                 }
260
261                 ++ptr;
262         }
263         if (msgstart > msg) {
264                 strcpy(msg, msgstart);
265         }
266
267         /* Now go through the message, parsing tags as necessary. */
268         converted_msg = NewStrBufPlain(NULL, content_length + 8192);
269
270         /* Convert foreign character sets to UTF-8 if necessary. */
271         if ((strcasecmp(charset, "us-ascii"))
272             && (strcasecmp(charset, "UTF-8"))
273             && (strcasecmp(charset, ""))
274             ) {
275                 syslog(LOG_DEBUG, "Converting %s to UTF-8", charset);
276                 ctdl_iconv_open("UTF-8", charset, &ic);
277                 if (ic == (iconv_t) (-1)) {
278                         syslog(LOG_WARNING, "%s:%d iconv_open() failed: %s", __FILE__, __LINE__, strerror(errno));
279                 }
280         }
281         if (Source == NULL) {
282                 if (ic != (iconv_t) (-1)) {
283                         ibuf = msg;
284                         ibuflen = content_length;
285                         obuflen = content_length + (content_length / 2);
286                         obuf = (char *) malloc(obuflen);
287                         osav = obuf;
288                         iconv(ic, &ibuf, &ibuflen, &obuf, &obuflen);
289                         content_length = content_length + (content_length / 2) - obuflen;
290                         osav[content_length] = 0;
291                         free(msg);
292                         msg = osav;
293                         iconv_close(ic);
294                 }
295         } else {
296                 if (ic != (iconv_t) (-1)) {
297                         StrBuf *Buf = NewStrBufPlain(NULL, StrLength(Source) + 8096);;
298                         StrBufConvert(Source, Buf, &ic);
299                         FreeStrBuf(&Buf);
300                         iconv_close(ic);
301                         msg = (char *) ChrPtr(Source);  /* TODO: get rid of this. */
302                 }
303         }
304
305         /*
306          * At this point, the message has been stripped down to
307          * only the content inside the <BODY></BODY> tags, and has
308          * been converted to UTF-8 if it was originally in a foreign
309          * character set.  The text is also guaranteed to be null
310          * terminated now.
311          */
312
313         if (converted_msg == NULL) {
314                 StrBufAppendPrintf(Target, "Error %d: %s<br>%s:%d", errno, strerror(errno), __FILE__, __LINE__);
315                 goto BAIL;
316         }
317
318         if (BodyArea != NULL) { // Any attributes that were declared in the <body> tag
319                 StrBufAppendBufPlain(converted_msg, HKEY("<div "), 0);  // are instead declared in this <div> tag
320                 StrBufAppendBuf(converted_msg, BodyArea, 0);
321                 StrBufAppendBufPlain(converted_msg, HKEY(">"), 0);
322         }
323         ptr = msg;
324         msgend = strchr(msg, 0);
325         while (ptr < msgend) {
326
327                 /* Try to sanitize the html of any rogue scripts */
328                 if (!strncasecmp(ptr, "<script", 7)) {
329                         if (scriptlevel == 0) {
330                                 script_start_pos = StrLength(converted_msg);
331                         }
332                         ++scriptlevel;
333                 }
334                 if (!strncasecmp(ptr, "</script", 8)) {
335                         --scriptlevel;
336                 }
337
338                 /*
339                  * Change mailto: links to WebCit mail, by replacing the
340                  * link with one that points back to our mail room.  Due to
341                  * the way we parse URL's, it'll even handle mailto: links
342                  * that have "?subject=" in them.
343                  */
344                 if (!strncasecmp(ptr, "<a href=\"mailto:", 16)) {
345                         content_length += 64;
346                         StrBufAppendPrintf(converted_msg, "<a href=\"display_enter?force_room=_MAIL_?recp=");   // FIXME make compatible with webcit-ng
347                         ptr = &ptr[16];
348                         ++alevel;
349                         ++brak;
350                 }
351                 /* Make external links open in a separate window */
352                 else if (!strncasecmp(ptr, "<a href=\"", 9)) {
353                         ++alevel;
354                         ++brak;
355                         if (((strchr(ptr, ':') < strchr(ptr, '/'))) && ((strchr(ptr, '/') < strchr(ptr, '>')))) {
356                                 /* open external links to new window */
357                                 StrBufAppendPrintf(converted_msg, new_window);
358                                 ptr = &ptr[8];
359                         } else if ((treat_as_wiki)
360                                    && (strncasecmp(ptr, "<a href=\"wiki?", 14))
361                                    && (strncasecmp(ptr, "<a href=\"dotgoto?", 17))
362                                    && (strncasecmp(ptr, "<a href=\"knrooms?", 17))
363                             ) {
364                                 content_length += 64;
365                                 StrBufAppendPrintf(converted_msg, "<a href=\"wiki?go=");
366                                 //StrBufUrlescAppend(converted_msg, "FIXME ROOM NAME", NULL);                   // FIXME make compatible with webcit-ng
367                                 StrBufAppendPrintf(converted_msg, "?page=");
368                                 ptr = &ptr[9];
369                         } else {
370                                 StrBufAppendPrintf(converted_msg, "<a href=\"");
371                                 ptr = &ptr[9];
372                         }
373                 }
374                 /* Fixup <img src="cid:... ...> to fetch the mime part */
375                 else if (!strncasecmp(ptr, "<img ", 5)) {
376                         char *cid_start, *cid_end;
377                         char *tag_end = strchr(ptr, '>');
378                         char *src;
379                         /* FIXME - handle this situation (maybe someone opened an <img cid... 
380                          * and then ended the message)
381                          */
382                         if (!tag_end) {
383                                 syslog(LOG_DEBUG, "tag_end is null and ptr is:");
384                                 syslog(LOG_DEBUG, "%s", ptr);
385                                 syslog(LOG_DEBUG, "Theoretical bytes remaining: %d", (int) (msgend - ptr));
386                         }
387
388                         src = strstr(ptr, "src=\"cid:");
389                         ++brak;
390
391                         if (src && isspace(*(src - 1))
392                             && tag_end && (cid_start = strchr(src, ':'))
393                             && (cid_end = strchr(cid_start, '"'))
394                             && (cid_end < tag_end)
395                             ) {
396                                 /* copy tag and attributes up to src="cid: */
397                                 StrBufAppendBufPlain(converted_msg, ptr, src - ptr, 0);
398                                 cid_start++;
399
400                                 /* add in /webcit/mimepart/<msgnum>/CID/ 
401                                    trailing / stops dumb URL filters getting excited */
402                                 StrBufAppendPrintf(converted_msg, " src=\"/ctdl/r/");
403                                 StrBufXMLEscAppend(converted_msg, NULL, roomname, strlen(roomname), 0);
404                                 syslog(LOG_DEBUG, "room name is '%s'", roomname);
405                                 StrBufAppendPrintf(converted_msg, "/%ld/", msgnum);
406                                 StrBufAppendBufPlain(converted_msg, cid_start, cid_end - cid_start, 0);
407                                 StrBufAppendBufPlain(converted_msg, "\"", -1, 0);
408                                 ptr = cid_end + 1;
409                         }
410                         StrBufAppendBufPlain(converted_msg, ptr, tag_end - ptr, 0);
411                         ptr = tag_end;
412                 }
413
414                 /*
415                  * Turn anything that looks like a URL into a real link, as long
416                  * as it's not inside a tag already
417                  */
418                 else if ((brak == 0) && (alevel == 0) && ((!strncasecmp(ptr, "http://", 7)) || (!strncasecmp(ptr, "https://", 8)))) {
419                         /* Find the end of the link */
420                         int strlenptr;
421                         linklen = 0;
422
423                         strlenptr = strlen(ptr);
424                         for (i = 0; i <= strlenptr; ++i) {
425                                 if ((ptr[i] == 0)
426                                     || (isspace(ptr[i]))
427                                     || (ptr[i] == 10)
428                                     || (ptr[i] == 13)
429                                     || (ptr[i] == '(')
430                                     || (ptr[i] == ')')
431                                     || (ptr[i] == '<')
432                                     || (ptr[i] == '>')
433                                     || (ptr[i] == '[')
434                                     || (ptr[i] == ']')
435                                     || (ptr[i] == '"')
436                                     || (ptr[i] == '\'')
437                                     )
438                                         linklen = i;
439                                 /* entity tag? */
440                                 if (ptr[i] == '&') {
441                                         if ((ptr[i + 2] == ';') ||
442                                             (ptr[i + 3] == ';') ||
443                                             (ptr[i + 5] == ';') || (ptr[i + 6] == ';') || (ptr[i + 7] == ';'))
444                                                 linklen = i;
445                                 }
446                                 if (linklen > 0)
447                                         break;
448                         }
449                         if (linklen > 0) {
450                                 char *ltreviewptr;
451                                 char *nbspreviewptr;
452                                 char linkedchar;
453                                 int len;
454
455                                 len = linklen;
456                                 linkedchar = ptr[len];
457                                 ptr[len] = '\0';
458                                 /* spot for some subject strings tinymce tends to give us. */
459                                 ltreviewptr = strchr(ptr, '<');
460                                 if (ltreviewptr != NULL) {
461                                         *ltreviewptr = '\0';
462                                         linklen = ltreviewptr - ptr;
463                                 }
464
465                                 nbspreviewptr = strstr(ptr, "&nbsp;");
466                                 if (nbspreviewptr != NULL) {
467                                         /* nbspreviewptr = '\0'; */
468                                         linklen = nbspreviewptr - ptr;
469                                 }
470                                 if (ltreviewptr != 0)
471                                         *ltreviewptr = '<';
472
473                                 ptr[len] = linkedchar;
474
475                                 content_length += (32 + linklen);
476                                 StrBufAppendPrintf(converted_msg, "%s\"", new_window);
477                                 StrBufAppendBufPlain(converted_msg, ptr, linklen, 0);
478                                 StrBufAppendPrintf(converted_msg, "\">");
479                                 StrBufAppendBufPlain(converted_msg, ptr, linklen, 0);
480                                 ptr += linklen;
481                                 StrBufAppendPrintf(converted_msg, "</a>");
482                         }
483                 } else {
484                         StrBufAppendBufPlain(converted_msg, ptr, 1, 0);
485                         ptr++;
486                 }
487
488                 if ((ptr >= msg) && (ptr <= msgend)) {
489                         /*
490                          * We need to know when we're inside a tag,
491                          * so we don't turn things that look like URL's into
492                          * links, when they're already links - or image sources.
493                          */
494                         if ((ptr > msg) && (*(ptr - 1) == '<')) {
495                                 ++brak;
496                         }
497                         if ((ptr > msg) && (*(ptr - 1) == '>')) {
498                                 --brak;
499                                 if ((scriptlevel == 0) && (script_start_pos >= 0)) {
500                                         StrBufCutRight(converted_msg, StrLength(converted_msg) - script_start_pos);
501                                         script_start_pos = (-1);
502                                 }
503                         }
504                         if (!strncasecmp(ptr, "</a>", 3))
505                                 --alevel;
506                 }
507         }
508
509         if (BodyArea != NULL) {
510                 StrBufAppendBufPlain(converted_msg, HKEY("</div>"), 0); // Close the div where we declared attributes copied
511                 FreeStrBuf(&BodyArea);  // from the original <body> tag
512         }
513
514         /*      uncomment these two lines to override conversion        */
515         /*      memcpy(converted_msg, msg, content_length);             */
516         /*      output_length = content_length;                         */
517
518         /* Output our big pile of markup */
519         StrBufAppendBuf(Target, converted_msg, 0);
520
521       BAIL:                     /* A little trailing vertical whitespace... */
522         StrBufAppendPrintf(Target, "<br>\n");
523
524         /* Now give back the memory */
525         FreeStrBuf(&converted_msg);
526         if ((msg != NULL) && (Source == NULL))
527                 free(msg);
528         return (Target);
529 }
530
531
532 /*
533  * Look for URL's embedded in a buffer and make them linkable.  We use a
534  * target window in order to keep the Citadel session in its own window.
535  */
536 void UrlizeText(StrBuf * Target, StrBuf * Source, StrBuf * WrkBuf)
537 {
538         int len, UrlLen, Offset, TrailerLen;
539         const char *start, *end, *pos;
540
541         FlushStrBuf(Target);
542         start = NULL;
543         len = StrLength(Source);
544         end = ChrPtr(Source) + len;
545         for (pos = ChrPtr(Source); (pos < end) && (start == NULL); ++pos) {
546                 if (!strncasecmp(pos, "http://", 7))
547                         start = pos;
548                 else if (!strncasecmp(pos, "ftp://", 6))
549                         start = pos;
550         }
551
552         if (start == NULL) {
553                 StrBufAppendBuf(Target, Source, 0);
554                 return;
555         }
556         FlushStrBuf(WrkBuf);
557
558         for (pos = ChrPtr(Source) + len; pos > start; --pos) {
559                 if ((!isprint(*pos))
560                     || (isspace(*pos))
561                     || (*pos == '{')
562                     || (*pos == '}')
563                     || (*pos == '|')
564                     || (*pos == '\\')
565                     || (*pos == '^')
566                     || (*pos == '[')
567                     || (*pos == ']')
568                     || (*pos == '`')
569                     || (*pos == '<')
570                     || (*pos == '>')
571                     || (*pos == '(')
572                     || (*pos == ')')
573                     ) {
574                         end = pos;
575                 }
576         }
577
578         UrlLen = end - start;
579         StrBufAppendBufPlain(WrkBuf, start, UrlLen, 0);
580
581         Offset = start - ChrPtr(Source);
582         if (Offset != 0)
583                 StrBufAppendBufPlain(Target, ChrPtr(Source), Offset, 0);
584         StrBufAppendPrintf(Target, "%ca href=%c%s%c TARGET=%c%s%c%c%s%c/A%c",
585                            LB, QU, ChrPtr(WrkBuf), QU, QU, TARGET, QU, RB, ChrPtr(WrkBuf), LB, RB);
586
587         TrailerLen = StrLength(Source) - (end - ChrPtr(Source));
588         if (TrailerLen > 0)
589                 StrBufAppendBufPlain(Target, end, TrailerLen, 0);
590 }
591
592
593 void url(char *buf, size_t bufsize)
594 {
595         int len, UrlLen, Offset, TrailerLen, outpos;
596         char *start, *end, *pos;
597         char urlbuf[SIZ];
598         char outbuf[SIZ];
599
600         start = NULL;
601         len = strlen(buf);
602         if (len > bufsize) {
603                 syslog(LOG_WARNING, "URL: content longer than buffer!");
604                 return;
605         }
606         end = buf + len;
607         for (pos = buf; (pos < end) && (start == NULL); ++pos) {
608                 if (!strncasecmp(pos, "http://", 7))
609                         start = pos;
610                 if (!strncasecmp(pos, "ftp://", 6))
611                         start = pos;
612         }
613
614         if (start == NULL)
615                 return;
616
617         for (pos = buf + len; pos > start; --pos) {
618                 if ((!isprint(*pos))
619                     || (isspace(*pos))
620                     || (*pos == '{')
621                     || (*pos == '}')
622                     || (*pos == '|')
623                     || (*pos == '\\')
624                     || (*pos == '^')
625                     || (*pos == '[')
626                     || (*pos == ']')
627                     || (*pos == '`')
628                     || (*pos == '<')
629                     || (*pos == '>')
630                     || (*pos == '(')
631                     || (*pos == ')')
632                     ) {
633                         end = pos;
634                 }
635         }
636
637         UrlLen = end - start;
638         if (UrlLen > sizeof(urlbuf)) {
639                 syslog(LOG_WARNING, "URL: content longer than buffer!");
640                 return;
641         }
642         memcpy(urlbuf, start, UrlLen);
643         urlbuf[UrlLen] = '\0';
644
645         Offset = start - buf;
646         if ((Offset != 0) && (Offset < sizeof(outbuf)))
647                 memcpy(outbuf, buf, Offset);
648         outpos = snprintf(&outbuf[Offset], sizeof(outbuf) - Offset,
649                           "%ca href=%c%s%c TARGET=%c%s%c%c%s%c/A%c", LB, QU, urlbuf, QU, QU, TARGET, QU, RB, urlbuf, LB, RB);
650         if (outpos >= sizeof(outbuf) - Offset) {
651                 syslog(LOG_WARNING, "URL: content longer than buffer!");
652                 return;
653         }
654
655         TrailerLen = len - (end - start);
656         if (TrailerLen > 0)
657                 memcpy(outbuf + Offset + outpos, end, TrailerLen);
658         if (Offset + outpos + TrailerLen > bufsize) {
659                 syslog(LOG_WARNING, "URL: content longer than buffer!");
660                 return;
661         }
662         memcpy(buf, outbuf, Offset + outpos + TrailerLen);
663         *(buf + Offset + outpos + TrailerLen) = '\0';
664 }