#include "libinjection_html5.h"

#include <string.h>

#include <assert.h>

#ifdef DEBUG

#include <stdio.h>

#define TRACE() printf("%s:%d\n", __FUNCTION__, __LINE__)

#else

#define TRACE()

#endif

#define CHAR_EOF -1

#define CHAR_NULL 0

#define CHAR_BANG 33

#define CHAR_DOUBLE 34

#define CHAR_PERCENT 37

#define CHAR_SINGLE 39

#define CHAR_DASH 45

#define CHAR_SLASH 47

#define CHAR_LT 60

#define CHAR_EQUALS 61

#define CHAR_GT 62

#define CHAR_QUESTION 63

#define CHAR_RIGHTB 93

#define CHAR_TICK 96

/* prototypes */

static int h5_skip_white(h5_state_t* hs);

static int h5_is_white(char c);

static int h5_state_eof(h5_state_t* hs);

static int h5_state_data(h5_state_t* hs);

static int h5_state_tag_open(h5_state_t* hs);

static int h5_state_tag_name(h5_state_t* hs);

static int h5_state_tag_name_close(h5_state_t* hs);

static int h5_state_end_tag_open(h5_state_t* hs);

static int h5_state_self_closing_start_tag(h5_state_t* hs);

static int h5_state_attribute_name(h5_state_t* hs);

static int h5_state_after_attribute_name(h5_state_t* hs);

static int h5_state_before_attribute_name(h5_state_t* hs);

static int h5_state_before_attribute_value(h5_state_t* hs);

static int h5_state_attribute_value_double_quote(h5_state_t* hs);

static int h5_state_attribute_value_single_quote(h5_state_t* hs);

static int h5_state_attribute_value_back_quote(h5_state_t* hs);

static int h5_state_attribute_value_no_quote(h5_state_t* hs);

static int h5_state_after_attribute_value_quoted_state(h5_state_t* hs);

static int h5_state_comment(h5_state_t* hs);

static int h5_state_cdata(h5_state_t* hs);

/* 12.2.4.44 */

static int h5_state_bogus_comment(h5_state_t* hs);

static int h5_state_bogus_comment2(h5_state_t* hs);

/* 12.2.4.45 */

static int h5_state_markup_declaration_open(h5_state_t* hs);

/* 8.2.4.52 */

static int h5_state_doctype(h5_state_t* hs);

/**

 * public function

 */

void libinjection_h5_init(h5_state_t* hs, const char* s, size_t len, enum html5_flags flags)

{

    memset(hs, 0, sizeof(h5_state_t));

    hs->s = s;

    hs->len = len;

    switch (flags) {

    case DATA_STATE:

        hs->state = h5_state_data;

        break;

    case VALUE_NO_QUOTE:

        hs->state = h5_state_before_attribute_name;

        break;

    case VALUE_SINGLE_QUOTE:

        hs->state = h5_state_attribute_value_single_quote;

        break;

    case VALUE_DOUBLE_QUOTE:

        hs->state = h5_state_attribute_value_double_quote;

        break;

    case VALUE_BACK_QUOTE:

        hs->state = h5_state_attribute_value_back_quote;

        break;

    }

}

/**

 * public function

 */

int libinjection_h5_next(h5_state_t* hs)

{

    assert(hs->state != NULL);

    return (*hs->state)(hs);

}

/**

 * Everything below here is private

 *

 */

static int h5_is_white(char ch)

{

    /*

     * \t = horizontal tab = 0x09

     * \n = newline = 0x0A

     * \v = vertical tab = 0x0B

     * \f = form feed = 0x0C

     * \r = cr  = 0x0D

     */

    return strchr(" \t\n\v\f\r", ch) != NULL;

}

static int h5_skip_white(h5_state_t* hs)

{

    char ch;

    while (hs->pos < hs->len) {

        ch = hs->s[hs->pos];

        switch (ch) {

        case 0x00: /* IE only */

        case 0x20:

        case 0x09:

        case 0x0A:

        case 0x0B: /* IE only */

        case 0x0C:

        case 0x0D: /* IE only */

            hs->pos += 1;

            break;

        default:

            return ch;

        }

    }

    return CHAR_EOF;

}

static int h5_state_eof(h5_state_t* hs)

{

    /* eliminate unused function argument warning */

    (void)hs;

    return 0;

}

static int h5_state_data(h5_state_t* hs)

{

    const char* idx;

    TRACE();

    assert(hs->len >= hs->pos);

    idx = (const char*) memchr(hs->s + hs->pos, CHAR_LT, hs->len - hs->pos);

    if (idx == NULL) {

        hs->token_start = hs->s + hs->pos;

        hs->token_len = hs->len - hs->pos;

        hs->token_type = DATA_TEXT;

        hs->state = h5_state_eof;

        if (hs->token_len == 0) {

            return 0;

        }

    } else {

        hs->token_start = hs->s + hs->pos;

        hs->token_type = DATA_TEXT;

        hs->token_len = (size_t)(idx - hs->s) - hs->pos;

        hs->pos = (size_t)(idx - hs->s) + 1;

        hs->state = h5_state_tag_open;

        if (hs->token_len == 0) {

            return h5_state_tag_open(hs);

        }

    }

    return 1;

}

/**

 * 12 2.4.8

 */

static int h5_state_tag_open(h5_state_t* hs)

{

    char ch;

    TRACE();

    if (hs->pos >= hs->len) {

        return 0;

    }

    ch = hs->s[hs->pos];

    if (ch == CHAR_BANG) {

        hs->pos += 1;

        return h5_state_markup_declaration_open(hs);

    } else if (ch == CHAR_SLASH) {

        hs->pos += 1;

        hs->is_close = 1;

        return h5_state_end_tag_open(hs);

    } else if (ch == CHAR_QUESTION) {

        hs->pos += 1;

        return h5_state_bogus_comment(hs);

    } else if (ch == CHAR_PERCENT) {

        /* this is not in spec.. alternative comment format used

           by IE <= 9 and Safari < 4.0.3 */

        hs->pos += 1;

        return h5_state_bogus_comment2(hs);

    } else if ((ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z')) {

        return h5_state_tag_name(hs);

    } else if (ch == CHAR_NULL) {

        /* IE-ism  NULL characters are ignored */

        return h5_state_tag_name(hs);

    } else {

        /* user input mistake in configuring state */

        if (hs->pos == 0) {

            return h5_state_data(hs);

        }

        hs->token_start = hs->s + hs->pos - 1;

        hs->token_len = 1;

        hs->token_type = DATA_TEXT;

        hs->state = h5_state_data;

        return 1;

    }

}

/**

 * 12.2.4.9

 */

static int h5_state_end_tag_open(h5_state_t* hs)

{

    char ch;

    TRACE();

    if (hs->pos >= hs->len) {

        return 0;

    }

    ch = hs->s[hs->pos];

    if (ch == CHAR_GT) {

        return h5_state_data(hs);

    } else if ((ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z')) {

        return h5_state_tag_name(hs);

    }

    hs->is_close = 0;

    return h5_state_bogus_comment(hs);

}

/*

 *

 */

static int h5_state_tag_name_close(h5_state_t* hs)

{

    TRACE();

    hs->is_close = 0;

    hs->token_start = hs->s + hs->pos;

    hs->token_len = 1;

    hs->token_type = TAG_NAME_CLOSE;

    hs->pos += 1;

    if (hs->pos < hs->len) {

        hs->state = h5_state_data;

    } else {

        hs->state = h5_state_eof;

    }

    return 1;

}

/**

 * 12.2.4.10

 */

static int h5_state_tag_name(h5_state_t* hs)

{

    char ch;

    size_t pos;

    TRACE();

    pos = hs->pos;

    while (pos < hs->len) {

        ch = hs->s[pos];

        if (ch == 0) {

            /* special non-standard case */

            /* allow nulls in tag name   */

            /* some old browsers apparently allow and ignore them */

            pos += 1;

        } else if (h5_is_white(ch)) {

            hs->token_start = hs->s + hs->pos;

            hs->token_len = pos - hs->pos;

            hs->token_type = TAG_NAME_OPEN;

            hs->pos = pos + 1;

            hs->state = h5_state_before_attribute_name;

            return 1;

        } else if (ch == CHAR_SLASH) {

            hs->token_start = hs->s + hs->pos;

            hs->token_len = pos - hs->pos;

            hs->token_type = TAG_NAME_OPEN;

            hs->pos = pos + 1;

            hs->state = h5_state_self_closing_start_tag;

            return 1;

        } else if (ch == CHAR_GT) {

            hs->token_start = hs->s + hs->pos;

            hs->token_len = pos - hs->pos;

            if (hs->is_close) {

                hs->pos = pos + 1;

                hs->is_close = 0;

                hs->token_type = TAG_CLOSE;

                hs->state = h5_state_data;

            } else {

                hs->pos = pos;

                hs->token_type = TAG_NAME_OPEN;

                hs->state = h5_state_tag_name_close;

            }

            return 1;

        } else {

            pos += 1;

        }

    }

    hs->token_start = hs->s + hs->pos;

    hs->token_len = hs->len - hs->pos;

    hs->token_type = TAG_NAME_OPEN;

    hs->state = h5_state_eof;

    return 1;

}

/**

 * 12.2.4.34

 */

static int h5_state_before_attribute_name(h5_state_t* hs)

{

    int ch;

    TRACE();

    ch = h5_skip_white(hs);

    switch (ch) {

    case CHAR_EOF: {

        return 0;

    }

    case CHAR_SLASH: {

        hs->pos += 1;

        return h5_state_self_closing_start_tag(hs);

    }

    case CHAR_GT: {

        hs->state = h5_state_data;

        hs->token_start = hs->s + hs->pos;

        hs->token_len = 1;

        hs->token_type = TAG_NAME_CLOSE;

        hs->pos += 1;

        return 1;

    }

    default: {

        return h5_state_attribute_name(hs);

    }

    }

}

static int h5_state_attribute_name(h5_state_t* hs)

{

    char ch;

    size_t pos;

    TRACE();

    pos = hs->pos + 1;

    while (pos < hs->len) {

        ch = hs->s[pos];

        if (h5_is_white(ch)) {

            hs->token_start = hs->s + hs->pos;

            hs->token_len   = pos - hs->pos;

            hs->token_type  = ATTR_NAME;

            hs->state = h5_state_after_attribute_name;

            hs->pos = pos + 1;

            return 1;

        } else if (ch == CHAR_SLASH) {

            hs->token_start = hs->s + hs->pos;

            hs->token_len   = pos - hs->pos;

            hs->token_type  = ATTR_NAME;

            hs->state = h5_state_self_closing_start_tag;

            hs->pos = pos + 1;

            return 1;

        } else if (ch == CHAR_EQUALS) {

            hs->token_start = hs->s + hs->pos;

            hs->token_len   = pos - hs->pos;

            hs->token_type  = ATTR_NAME;

            hs->state = h5_state_before_attribute_value;

            hs->pos = pos + 1;

            return 1;

        } else if (ch == CHAR_GT) {

            hs->token_start = hs->s + hs->pos;

            hs->token_len   = pos - hs->pos;

            hs->token_type  = ATTR_NAME;

            hs->state = h5_state_tag_name_close;

            hs->pos = pos;

            return 1;

        } else {

            pos += 1;

        }

    }

    /* EOF */

    hs->token_start = hs->s + hs->pos;

    hs->token_len   = hs->len - hs->pos;

    hs->token_type  = ATTR_NAME;

    hs->state = h5_state_eof;

    hs->pos = hs->len;

    return 1;

}

/**

 * 12.2.4.36

 */

static int h5_state_after_attribute_name(h5_state_t* hs)

{

    int c;

    TRACE();

    c = h5_skip_white(hs);

    switch (c) {

    case CHAR_EOF: {

        return 0;

    }

    case CHAR_SLASH: {

        hs->pos += 1;

        return h5_state_self_closing_start_tag(hs);

    }

    case CHAR_EQUALS: {

        hs->pos += 1;

        return h5_state_before_attribute_value(hs);

    }

    case CHAR_GT: {

        return h5_state_tag_name_close(hs);

    }

    default: {

        return h5_state_attribute_name(hs);

    }

    }

}

/**

 * 12.2.4.37

 */

static int h5_state_before_attribute_value(h5_state_t* hs)

{

    int c;

    TRACE();

    c = h5_skip_white(hs);

    if (c == CHAR_EOF) {

        hs->state = h5_state_eof;

        return 0;

    }

    if (c == CHAR_DOUBLE) {

        return h5_state_attribute_value_double_quote(hs);

    } else if (c == CHAR_SINGLE) {

        return h5_state_attribute_value_single_quote(hs);

    } else if (c == CHAR_TICK) {

        /* NON STANDARD IE */

        return h5_state_attribute_value_back_quote(hs);

    } else {

        return h5_state_attribute_value_no_quote(hs);

    }

}

static int h5_state_attribute_value_quote(h5_state_t* hs, char qchar)

{

    const char* idx;

    TRACE();

    /* skip initial quote in normal case.

     * don't do this "if (pos == 0)" since it means we have started

     * in a non-data state.  given an input of '>

     * we want to make 0-length attribute name

     */

    if (hs->pos > 0) {

        hs->pos += 1;

    }

    idx = (const char*) memchr(hs->s + hs->pos, qchar, hs->len - hs->pos);

    if (idx == NULL) {

        hs->token_start = hs->s + hs->pos;

        hs->token_len = hs->len - hs->pos;

        hs->token_type = ATTR_VALUE;

        hs->state = h5_state_eof;

    } else {

        hs->token_start = hs->s + hs->pos;

        hs->token_len = (size_t)(idx - hs->s) - hs->pos;

        hs->token_type = ATTR_VALUE;

        hs->state = h5_state_after_attribute_value_quoted_state;

        hs->pos += hs->token_len + 1;

    }

    return 1;

}

static

int h5_state_attribute_value_double_quote(h5_state_t* hs)

{

    TRACE();

    return h5_state_attribute_value_quote(hs, CHAR_DOUBLE);

}

static

int h5_state_attribute_value_single_quote(h5_state_t* hs)

{

    TRACE();

    return h5_state_attribute_value_quote(hs, CHAR_SINGLE);

}

static

int h5_state_attribute_value_back_quote(h5_state_t* hs)

{

    TRACE();

    return h5_state_attribute_value_quote(hs, CHAR_TICK);

}

static int h5_state_attribute_value_no_quote(h5_state_t* hs)

{

    char ch;

    size_t pos;

    TRACE();

    pos = hs->pos;

    while (pos < hs->len) {

        ch = hs->s[pos];

        if (h5_is_white(ch)) {

            hs->token_type = ATTR_VALUE;

            hs->token_start = hs->s + hs->pos;

            hs->token_len = pos - hs->pos;

            hs->pos = pos + 1;

            hs->state = h5_state_before_attribute_name;

            return 1;

        } else if (ch == CHAR_GT) {

            hs->token_type = ATTR_VALUE;

            hs->token_start = hs->s + hs->pos;

            hs->token_len = pos - hs->pos;

            hs->pos = pos;

            hs->state = h5_state_tag_name_close;

            return 1;

        }

        pos += 1;

    }

    TRACE();

    /* EOF */

    hs->state = h5_state_eof;

    hs->token_start = hs->s + hs->pos;

    hs->token_len = hs->len - hs->pos;

    hs->token_type = ATTR_VALUE;

    return 1;

}

/**

 * 12.2.4.41

 */

static int h5_state_after_attribute_value_quoted_state(h5_state_t* hs)

{

    char ch;

    TRACE();

    if (hs->pos >= hs->len) {

        return 0;

    }

    ch = hs->s[hs->pos];

    if (h5_is_white(ch)) {

        hs->pos += 1;

        return h5_state_before_attribute_name(hs);

    } else if (ch == CHAR_SLASH) {

        hs->pos += 1;

        return h5_state_self_closing_start_tag(hs);

    } else if (ch == CHAR_GT) {

        hs->token_start = hs->s + hs->pos;

        hs->token_len = 1;

        hs->token_type = TAG_NAME_CLOSE;

        hs->pos += 1;

        hs->state = h5_state_data;

        return 1;

    } else {

        return h5_state_before_attribute_name(hs);

    }

}

/**

 * 12.2.4.43

 */

static int h5_state_self_closing_start_tag(h5_state_t* hs)

{

    char ch;

    TRACE();

    if (hs->pos >= hs->len) {

        return 0;

    }

    ch = hs->s[hs->pos];

    if (ch == CHAR_GT) {

        assert(hs->pos > 0);

        hs->token_start = hs->s + hs->pos -1;

        hs->token_len = 2;

        hs->token_type = TAG_NAME_SELFCLOSE;

        hs->state = h5_state_data;

        hs->pos += 1;

        return 1;

    } else {

        return h5_state_before_attribute_name(hs);

    }

}

/**

 * 12.2.4.44

 */

static int h5_state_bogus_comment(h5_state_t* hs)

{

    const char* idx;

    TRACE();

    idx = (const char*) memchr(hs->s + hs->pos, CHAR_GT, hs->len - hs->pos);

    if (idx == NULL) {

        hs->token_start = hs->s + hs->pos;

        hs->token_len = hs->len - hs->pos;

        hs->pos = hs->len;

        hs->state = h5_state_eof;

    } else {

        hs->token_start = hs->s + hs->pos;

        hs->token_len = (size_t)(idx - hs->s) - hs->pos;

        hs->pos =  (size_t)(idx - hs->s) + 1;

        hs->state = h5_state_data;

    }

    hs->token_type = TAG_COMMENT;

    return 1;

}

/**

 * 12.2.4.44 ALT

 */

static int h5_state_bogus_comment2(h5_state_t* hs)

{

    const char* idx;

    size_t pos;

    TRACE();

    pos = hs->pos;

    while (1) {

        idx = (const char*) memchr(hs->s + pos, CHAR_PERCENT, hs->len - pos);

        if (idx == NULL || (idx + 1 >= hs->s + hs->len)) {

            hs->token_start = hs->s + hs->pos;

            hs->token_len = hs->len - hs->pos;

            hs->pos = hs->len;

            hs->token_type = TAG_COMMENT;

            hs->state = h5_state_eof;

            return 1;

        }

        if (*(idx +1) != CHAR_GT) {

            pos = (size_t)(idx - hs->s) + 1;

            continue;

        }

        /* ends in %> */

        hs->token_start = hs->s + hs->pos;

        hs->token_len = (size_t)(idx - hs->s) - hs->pos;

        hs->pos = (size_t)(idx - hs->s) + 2;

        hs->state = h5_state_data;

        hs->token_type = TAG_COMMENT;

        return 1;

    }

}

/**

 * 8.2.4.45

 */

static int h5_state_markup_declaration_open(h5_state_t* hs)

{

    size_t remaining;

    TRACE();

    remaining = hs->len - hs->pos;

    if (remaining >= 7 &&

        /* case insensitive */

        (hs->s[hs->pos + 0] == 'D' || hs->s[hs->pos + 0] == 'd') &&

        (hs->s[hs->pos + 1] == 'O' || hs->s[hs->pos + 1] == 'o') &&

        (hs->s[hs->pos + 2] == 'C' || hs->s[hs->pos + 2] == 'c') &&

        (hs->s[hs->pos + 3] == 'T' || hs->s[hs->pos + 3] == 't') &&

        (hs->s[hs->pos + 4] == 'Y' || hs->s[hs->pos + 4] == 'y') &&

        (hs->s[hs->pos + 5] == 'P' || hs->s[hs->pos + 5] == 'p') &&

        (hs->s[hs->pos + 6] == 'E' || hs->s[hs->pos + 6] == 'e')

        ) {

        return h5_state_doctype(hs);

    } else if (remaining >= 7 &&

               /* upper case required */

               hs->s[hs->pos + 0] == '[' &&

               hs->s[hs->pos + 1] == 'C' &&

               hs->s[hs->pos + 2] == 'D' &&

               hs->s[hs->pos + 3] == 'A' &&

               hs->s[hs->pos + 4] == 'T' &&

               hs->s[hs->pos + 5] == 'A' &&

               hs->s[hs->pos + 6] == '['

        ) {

        hs->pos += 7;

        return h5_state_cdata(hs);

    } else if (remaining >= 2 &&

               hs->s[hs->pos + 0] == '-' &&

               hs->s[hs->pos + 1] == '-') {

        hs->pos += 2;

        return h5_state_comment(hs);

    }

    return h5_state_bogus_comment(hs);

}

/**

 * 12.2.4.48

 * 12.2.4.49

 * 12.2.4.50

 * 12.2.4.51

 *   state machine spec is confusing since it can only look

 *   at one character at a time but simply it's comments end by:

 *   1) EOF

 *   2) ending in -->

 *   3) ending in -!>

 */

static int h5_state_comment(h5_state_t* hs)

{

    char ch;

    const char* idx;

    size_t pos;

    size_t offset;

    const char* end = hs->s + hs->len;

    TRACE();

    pos = hs->pos;

    while (1) {

        idx = (const char*) memchr(hs->s + pos, CHAR_DASH, hs->len - pos);

        /* did not find anything or has less than 3 chars left */

        if (idx == NULL || idx > hs->s + hs->len - 3) {

            hs->state = h5_state_eof;

            hs->token_start = hs->s + hs->pos;

            hs->token_len = hs->len - hs->pos;

            hs->token_type = TAG_COMMENT;

            return 1;

        }

        offset = 1;

        /* skip all nulls */

        while (idx + offset < end && *(idx + offset) == 0) {

            offset += 1;

        }

        if (idx + offset == end) {

            hs->state = h5_state_eof;

            hs->token_start = hs->s + hs->pos;

            hs->token_len = hs->len - hs->pos;

            hs->token_type = TAG_COMMENT;

            return 1;

        }

        ch = *(idx + offset);

        if (ch != CHAR_DASH && ch != CHAR_BANG) {

            pos = (size_t)(idx - hs->s) + 1;

            continue;

        }

        /* need to test */

#if 0

        /* skip all nulls */

        while (idx + offset < end && *(idx + offset) == 0) {

            offset += 1;

        }

        if (idx + offset == end) {

            hs->state = h5_state_eof;

            hs->token_start = hs->s + hs->pos;

            hs->token_len = hs->len - hs->pos;

            hs->token_type = TAG_COMMENT;

            return 1;

        }

#endif

        offset += 1;

        if (idx + offset == end) {

            hs->state = h5_state_eof;

            hs->token_start = hs->s + hs->pos;

            hs->token_len = hs->len - hs->pos;

            hs->token_type = TAG_COMMENT;

            return 1;

        }

        ch = *(idx + offset);

        if (ch != CHAR_GT) {

            pos = (size_t)(idx - hs->s) + 1;

            continue;

        }

        offset += 1;

        /* ends in --> or -!> */

        hs->token_start = hs->s + hs->pos;

        hs->token_len = (size_t)(idx - hs->s) - hs->pos;

        hs->pos = (size_t)(idx + offset - hs->s);

        hs->state = h5_state_data;

        hs->token_type = TAG_COMMENT;

        return 1;

    }

}

static int h5_state_cdata(h5_state_t* hs)

{

    const char* idx;

    size_t pos;

    TRACE();

    pos = hs->pos;

    while (1) {

        idx = (const char*) memchr(hs->s + pos, CHAR_RIGHTB, hs->len - pos);

        /* did not find anything or has less than 3 chars left */

        if (idx == NULL || idx > hs->s + hs->len - 3) {

            hs->state = h5_state_eof;

            hs->token_start = hs->s + hs->pos;

            hs->token_len = hs->len - hs->pos;

            hs->token_type = DATA_TEXT;

            return 1;

        } else if ( *(idx+1) == CHAR_RIGHTB && *(idx+2) == CHAR_GT) {

            hs->state = h5_state_data;

            hs->token_start = hs->s + hs->pos;

            hs->token_len = (size_t)(idx - hs->s) - hs->pos;

            hs->pos = (size_t)(idx - hs->s) + 3;

            hs->token_type = DATA_TEXT;

            return 1;

        } else {

            pos = (size_t)(idx - hs->s) + 1;

        }

    }

}

/**

 * 8.2.4.52

 * http://www.w3.org/html/wg/drafts/html/master/syntax.html#doctype-state

 */

static int h5_state_doctype(h5_state_t* hs)

{

    const char* idx;

    TRACE();

    hs->token_start = hs->s + hs->pos;

    hs->token_type = DOCTYPE;

    idx = (const char*) memchr(hs->s + hs->pos, CHAR_GT, hs->len - hs->pos);

    if (idx == NULL) {

        hs->state = h5_state_eof;

        hs->token_len = hs->len - hs->pos;

    } else {

        hs->state = h5_state_data;

        hs->token_len = (size_t)(idx - hs->s) - hs->pos;

        hs->pos = (size_t)(idx - hs->s) + 1;

    }

    return 1;

}