Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Home
- /
- About test110
04-29-2021
test110
Calcite | Level 5
Member since
03-22-2021
- 4 Posts
- 0 Likes Given
- 0 Solutions
- 0 Likes Received
-
Latest posts by test110
Subject Views Posted 1261 04-26-2021 02:00 PM 1289 04-26-2021 01:36 PM 1300 04-26-2021 01:09 PM 1331 04-26-2021 12:46 PM -
Activity Feed for test110
- Posted Re: Proper encoding of Symbols passed to SAS over the Web on SAS Programming. 04-26-2021 02:00 PM
- Posted Re: Proper encoding of Symbols passed to SAS over the Web on SAS Programming. 04-26-2021 01:36 PM
- Posted Re: Proper encoding of Symbols passed to SAS over the Web on SAS Programming. 04-26-2021 01:09 PM
- Posted Proper encoding of Symbols passed to SAS over the Web on SAS Programming. 04-26-2021 12:46 PM
04-26-2021
02:00 PM
The value is being retrieved from the URL request here, with the actual value highlighted in red: https://sampleapplicationserver/cgi-bin/broker?_SERVICE=default&_PROGRAM=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&_ENTRY=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&BGTYPE=COLOR&BG=%23FFFFFF&DATASET=SA%27SHELP.RE%27TAIL&TEMPFILE=Unknown Just to reiterate, the %27 (single quotes) are not making it to the actual 'dataset' value, that it my question. Why are the single quotes not being interpreted? Other symbols, like: @$() seem to be interpreted alright, but the single quotes and percent signs, when passed in URL parameters do not get interpreted.
... View more
04-26-2021
01:36 PM
Please see below for the highlighted (in red) lines- For the URL portion: &DATASET=SA%27SHELP.RE%27TAIL For the code portion: line 4 (&dataset) Also, here is the full URL that is being used (it appears it got cut off earlier in the post): https://sampleapplicationserver/cgi-bin/broker?_SERVICE=default&_PROGRAM=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&_ENTRY=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&BGTYPE=COLOR&BG=%23FFFFFF&DATASET=SA%27SHELP.RE%27TAIL&TEMPFILE=Unknown %global bg bgtype dataset style tmpstyle;
%macro print_to_html;
%if not %sysfunc(exist(&dataset)) %then
%do;
data _null_;
file _webout;
put '<HTML>';
put '<HEAD>';
put '<TITLE>Missing Data Set</TITLE>';
put '</HEAD>';
bgtype = symget('bgtype');
if trim(upcase(bgtype))="COLOR" then put "<BODY BGCOLOR=&bg>";
else if trim(upcase(bgtype))="IMAGE" then put '<BODY BACKGROUND="' "&bg" '">';
else put '<BODY>';
put '<H1>Missing Data Set</H1>';
put "Data set &dataset not found.";
put '</BODY>';
put '</HTML>';
run;
%goto done;
%end;
%if &style ne %then
%let tmpstyle=style=styles.&style;
%else %if %UPCASE(&bgtype) eq COLOR %then
%do;
ods path work.templat(update)
sasuser.templat(read) sashelp.tmplmst(read);
proc template;
define style tmpstyle;
parent=styles.default;
style body from body / background=&bg;
style systemtitle from systemtitle / background=&bg;
style systemfooter from systemfooter / background=&bg;
style systitleandfootercontainer
from systitleandfootercontainer / background=&bg;
end;
run;
%let tmpstyle=style=tmpstyle;
%end;
%else %if %UPCASE(&bgtype) eq IMAGE %then
%do;
ods path work.templat(update)
sasuser.templat(read) sashelp.tmplmst(read);
proc template;
define style tmpstyle;
parent=styles.default;
style body from body / backgroundimage="&bg";
end;
run;
%let tmpstyle=style=tmpstyle;
%end;
%else
%let tmpstyle=;
ods html &tmpstyle body=_webout rs=none;
title "Data Set &dataset in HTML Format";
proc print data=&dataset;
run;
ods html close;
%done:
%mend print_to_html;
* HTML encode vulnerable values to prevent XSS injection;
data _null_;
call symputx('BG', htmlencode(symget('bg')));
call symputx('DATASET', htmlencode(symget('dataset')));
run;
%print_to_html;
... View more
04-26-2021
01:09 PM
Chris, thanks for the reply. I guess my question is, without modifying the previously provided code, why are the single quotes not being interpreted? Other URL encoded symbol characters such as the equal sign, question mark, etc are interpreted correctly, however, single quotes and percent signs appear to have no affect on the values.
... View more
04-26-2021
12:46 PM
Does the SAS interpreter remove single quotes for values passed in parameters over the web? For example, using the sample intrnet application below and the following webrequest: https://sampleapplicationserver/cgi-bin/broker?_SERVICE=default&_PROGRAM=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&_ENTRY=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&BGTYPE=COLOR&BG=%23FFFFFF&DATASET=SA'SHELP.RE'TAIL&TEMPFILE=Unknown The 'SASHELP.RETAIL' dataset is still rendered correctly despite the addition of single quotes (SA'SHELP.RE'TAIL). I have also tried URL encoding these to %27 and it still has no affect. %global bg bgtype dataset style tmpstyle;
%macro print_to_html;
%if not %sysfunc(exist(&dataset)) %then
%do;
data _null_;
file _webout;
put '<HTML>';
put '<HEAD>';
put '<TITLE>Missing Data Set</TITLE>';
put '</HEAD>';
bgtype = symget('bgtype');
if trim(upcase(bgtype))="COLOR" then put "<BODY BGCOLOR=&bg>";
else if trim(upcase(bgtype))="IMAGE" then put '<BODY BACKGROUND="' "&bg" '">';
else put '<BODY>';
put '<H1>Missing Data Set</H1>';
put "Data set &dataset not found.";
put '</BODY>';
put '</HTML>';
run;
%goto done;
%end;
%if &style ne %then
%let tmpstyle=style=styles.&style;
%else %if %UPCASE(&bgtype) eq COLOR %then
%do;
ods path work.templat(update)
sasuser.templat(read) sashelp.tmplmst(read);
proc template;
define style tmpstyle;
parent=styles.default;
style body from body / background=&bg;
style systemtitle from systemtitle / background=&bg;
style systemfooter from systemfooter / background=&bg;
style systitleandfootercontainer
from systitleandfootercontainer / background=&bg;
end;
run;
%let tmpstyle=style=tmpstyle;
%end;
%else %if %UPCASE(&bgtype) eq IMAGE %then
%do;
ods path work.templat(update)
sasuser.templat(read) sashelp.tmplmst(read);
proc template;
define style tmpstyle;
parent=styles.default;
style body from body / backgroundimage="&bg";
end;
run;
%let tmpstyle=style=tmpstyle;
%end;
%else
%let tmpstyle=;
ods html &tmpstyle body=_webout rs=none;
title "Data Set &dataset in HTML Format";
proc print data=&dataset;
run;
ods html close;
%done:
%mend print_to_html;
* HTML encode vulnerable values to prevent XSS injection;
data _null_;
call symputx('BG', htmlencode(symget('bg')));
call symputx('DATASET', htmlencode(symget('dataset')));
run;
%print_to_html;
... View more
