openbmc/build/tmp/deploy/sdk/witherspoon-2019-08-08/sysroots/armv6-openbmc-linux-gnueabi/usr/src/debug/rsyslog/8.1903.0-r0/rsyslog-8.1903.0/template.c
static void doEmergencyEscape(register uchar* p, int mode)
{
    while (*p)
    {
        if ((mode == SQL_ESCAPE || mode == STDSQL_ESCAPE) && *p == '\'')
        {
            *p = '"';
        }
        else if (mode == JSON_ESCAPE)
        {
            if (*p == '"')
            {
                *p = '\'';
            }
            else if (*p == '\\')
            {
                *p = '/';
            }
        }
        else if ((mode == SQL_ESCAPE) && *p == '\\')
        {
            *p = '/';
        }
        ++p;
    }
}
/* Helper to doEscape. This is called if doEscape
 * runs out of memory allocating the escaped string.
 * Then we are in trouble. We can
 * NOT simply return the unmodified string because this
 * may cause SQL injection. But we also can not simply
 * abort the run, this would be a DoS. I think an appropriate
 * measure is to remove the dangerous \' characters (SQL). We
 * replace them by \", which will break the message and
 * signatures eventually present - but this is the
 * best thing we can do now (or does anybody
 * have a better idea?). rgerhards 2004-11-23
 * added support for escape mode (see doEscape for details).
 * if mode = SQL_ESCAPE, then backslashes are changed to slashes.
 * rgerhards 2005-09-22
 */
Helper to doEscape. This is called if doEscape
runs out of memory allocating the escaped string.
Then we are in trouble. We can
NOT simply return the unmodified string because this
may cause SQL injection. But we also can not simply
abort the run, this would be a DoS. I think an appropriate
measure is to remove the dangerous \' characters (SQL). We
replace them by \", which will break the message and
signatures eventually present - but this is the
best thing we can do now (or does anybody
have a better idea?). rgerhards 2004-11-23
added support for escape mode .
if mode = SQL_ESCAPE, then backslashes are changed to slashes.
Helper to doEscape . This is called if doEscape runs out of memory allocating the escaped string . Then we are in trouble . We can NOT simply return the unmodified string because this may cause SQL injection . But we also can not simply abort the run this would be a DoS . I think an appropriate measure is to remove the dangerous \ ' characters ( SQL ) . We replace them by \ " which will break the message and signatures eventually present - but this is the best thing we can do now ( or does anybody have a better idea? ) . rgerhards 2004 - 11 - 23 added support for escape mode . if mode = SQL_ESCAPE then backslashes are changed to slashes .
static void doEmergencyEscape(register uchar* p, int mode)
{
    while (*p)
    {
        if ((mode == SQL_ESCAPE || mode == STDSQL_ESCAPE) && *p == '\'')
        {
            *p = '"';
        }
        else if (mode == JSON_ESCAPE)
        {
            if (*p == '"')
            {
                *p = '\'';
            }
            else if (*p == '\\')
            {
                *p = '/';
            }
        }
        else if ((mode == SQL_ESCAPE) && *p == '\\')
        {
            *p = '/';
        }
        ++p;
    }
}
static void doEmergencyEscape ( register uchar * p , int mode ) { while ( * p ) { if ( ( mode == SQL_ESCAPE || mode == STDSQL_ESCAPE ) && * p == ' \' ' ) { * p = ' ' ; } else if ( mode == JSON_ESCAPE ) { if ( * p == ' ' ) { * p = ' \' ' ; } else if ( * p == ' \\ ' ) { * p = ' ' ; } } else if ( ( mode == SQL_ESCAPE ) && * p == ' \\ ' ) { * p = ' ' ; } ++ p ; } }
Helper to doEscape.
Helper to doEscape .