Diff options
Diffstat (limited to 'source/html.c')
-rw-r--r--source/html.c11
1 file changed, 5 insertions, 6 deletions
diff --git a/source/html.c b/source/html.c
index 7ad4642..7d2e668 100644
--- a/source/html.c
+++ b/source/html.c
@@ -16,7 +16,11 @@
#define HTML_WRITE_BUFSIZE (64 * 1024)
// The percent encoding for each byte, with NULL marking the bytes a URL may
-// carry as themselves. Those are the letters, the digits, and !$()*,-./:;@[]_~
+// carry as themselves. An ampersand or plus is legal in a path but encoded all
+// the same, since a bare plus in a query argument decodes back as a space, and
+// an ampersand in an attribute value can start a character reference and
+// quietly turn "a&copy.txt" into a different filename. The bytes left as
+// themselves are the letters, the digits, and !$()*,-./:;@[]_~
static const char *url_escape_table[256] = {
"%00", "%01", "%02", "%03", "%04", "%05", "%06", "%07",
"%08", "%09", "%0A", "%0B", "%0C", "%0D", "%0E", "%0F",
@@ -388,11 +392,6 @@ void html_url_path(const char *txt)
while (p && *p) {
unsigned char c = *p;
- // A raw ampersand or plus is legal in a URL path, but this
- // table is shared with html_url_arg, where a bare plus decodes
- // back as a space, and the paths written here land in attribute
- // values, where an ampersand can start a character reference
- // and quietly turn "a&copy.txt" into a different filename.
const char *esc = url_escape_table[c];
if (esc) {
html_raw(txt, p - txt);