macros: Make get_url_encoded_string() rfc-compliant

The previous version had some inconsistencies compared to the
RFC. This patch corrects that so we now url-encode spaces as
%20. This lets us drop one part of exception handling, which
is a Good Thing(tm).

Style-fixes-by: Andreas Ericsson <ae@op5.se>
Commit-message-by: Andreas Ericsson <ae@op5.se>
Signed-off-by: Max Sikström <msikstrom@op5.com>
Signed-off-by: Andreas Ericsson <ae@op5.se>
macros: Refactor get_url_encoded_string()

sprintf()'ing to a temporary string and then strcat()'ing that temp
string in place is a bit dumb. This patch removes the superfluous
strcat() and sprintf()'s directly into the target string, which we
already know is large enough to hold the result.

Signed-off-by: Andreas Ericsson <ae@op5.se>
Macros: Fix encoding of macros.

Macros should be escaped based on where they're going to be used
rather than on where they come from.

URL-encoding macros should be done when building an URL, not if the
URL is included in the macro. Therefore, encoding options should only
be brought downwards, and only one level in the encoding.

An example:

notes: this is a string escaped with & and other chars for $HOSTADDRESS$
notes_url: http://example.org/?notes=$HOSTNOTES$&address=$HOSTADDRESS$
action_url: http://example.org/?notes_url=$HOSTNOTESURL$&notes=$HOSTNOTES$

The result should be something like:

notes:
address should be included, but not escaped. It should be readable
by a person

notes_url:
both notes and address should be url-encoded, because they are a part
of the url, but shouldn't change the structure of the url (like
including new variables)

action_url:
should urlencode notes_url, which means parts is double-encoded,
because the notes_url-attribute should, when unpacked by the web
server, contain the notes_url, and the notes should be encoded, so the
same applies to notes

While at it, we refactor get_url_encoded_string() somewhat to remove
the useless temp_expansion variable and issue sprintf() directly into
the result string, which we know is large enough to hold it.

Patch-modified-by: Andreas Ericsson <ae@op5.se>
Signed-off-by: Max Sikström <msikstrom@op5.com>
Signed-off-by: Andreas Ericsson <ae@op5.se>
Checks: Escape command line arguments correctly

Command line arguments should be stripped of a couple characters, so it isn't
possible to break out of for example strings, and start redirecting output and
write to files, given values of macros. And extra important is for macros that
can be updated from a user.

Previously, this wasn't that big issue, when macros itself could say that they
should be escaped. But the concept of escaping also depending which macro it
entered gives lot of other problems (notable for url:s at least, see previous
commit).

Only the requestor of the macro expansion knows where it's going to be used, so
only the requestor has the information to tell what to escape, and therefore,
this patch tells the macro expansion to escape the macros to be used as a
command line for check commands...

Signed-off-by: Max Sikström <msikstrom@op5.com>
Test macros: Initial tests for escaping of macros

This tests escaping and url-encoding of some macros

This doesn't test all macros, but the functionality of escaping.

Signed-off-by: Max Sikström <msikstrom@op5.com>