On Sat, Jun 22, 2019 at 01:22:56PM -0700, Kees Cook wrote: > On Sat, Jun 22, 2019 at 03:00:58PM -0400, J. Bruce Fields wrote: > > The logic around ESCAPE_NP and the "only" string is really confusing. I > > started assuming I could just add an ESCAPE_NONASCII flag and stick " > > and \ into the "only" string, but it doesn't work that way. > > Yeah, if ESCAPE_NP isn't specified, the "only" characters are passed > through. It'd be nice to have an "add" or a clearer way to do actual > ctype subsets, etc. If there isn't an obviously clear way to refactor > it, just skip it for now and I'm happy to ack your original patch. :) There may well be some simplification possible here.... There aren't really many users of "only", for example. I'll look into it some more. --b.
