Subject: 26.1; EWW stops renderring web page on null byte

From: Paul Eggert <[email-masked]>
Date: Wed, 27 Feb 2019 17:52:52 -0800

Thanks for fixing that bug. However, replacing NUL with \0 sounds iffy.
Even if we assume that a web page contains C-like code, the replacement
would mishandle a NUL followed by an octal digit, since the replacement
would look like \07 which would be interpreted as a BEL character, not
as a NULL followed by a digit 7. And web pages do not typically contain
C code, so the replacement \0 might cause other trouble.

Instead, it sounds better to replace NUL with the four-character
sequence "&#0;", as this is a standard HTML way to represent a NUL
character. I installed the attached patch to do this.

In my little tests with this patch, libxml2 typically handled &#0; by
discarding it and continuing to parse, which is better than ignoring the
rest of the input. In some cases libxml2 handles &#0; by discarding
later input up to a delimiter; although this is bad, it's a libxml2 bug
that attackers can exploit independently of what Emacs does with NUL,
since attackers can simply use &#0;.

>From f7c4d5ce2399fc86b130fd55d3da2c313403f638 Mon Sep 17 00:00:00 2001
From: Paul Eggert <[email-masked]>
Date: Wed, 27 Feb 2019 14:35:51 -0800
Subject: [PATCH] Escape HTML NUL as &#0; in eww

* lisp/net/eww.el (eww-display-html): Escape NUL as &#0; as this
is more appropriate for HTML.
---
 lisp/net/eww.el | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/lisp/net/eww.el b/lisp/net/eww.el
index 3ec6c1cfd3..3e9334532c 100644
--- a/lisp/net/eww.el
+++ b/lisp/net/eww.el
@@ -471,11 +471,9 @@ eww-display-html
 		    (decode-coding-region (point) (point-max) encode)
 		  (coding-system-error nil))
 		(save-excursion
-		  ;; Remove CRLF and NULL before parsing.
-                  (while (re-search-forward "\\(\r$\\)\\|\\(\000\\)" nil t)
-                    (replace-match (if (match-beginning 1)
-                                       ""
-                                     "\\0") t t)))
+		  ;; Remove CRLF and replace NUL with &#0; before parsing.
+		  (while (re-search-forward "\\(\r$\\)\\|\0" nil t)
+		    (replace-match (if (match-beginning 1) "" "&#0;") t t)))
 		(libxml-parse-html-region (point) (point-max))))))
 	(source (and (null document)
 		     (buffer-substring (point) (point-max)))))
-- 
2.20.1