From c43fdc30667e50b0852339d75b918bff33e90893 Mon Sep 17 00:00:00 2001
From: Kim Alvefur <zash@zash.se>
Date: Sun, 12 Sep 2021 12:18:28 +0200
Subject: [PATCH] Use xml.Marshal to safely build HTTP Upload <request>

Am I doing this Go thing correctly?
---
 httpupload.go | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/httpupload.go b/httpupload.go
index bd67b0e..efe5a53 100644
--- a/httpupload.go
+++ b/httpupload.go
@@ -70,6 +70,14 @@ func httpUpload(client *xmpp.Client, jserver string, filePath string) string {
 		} `xml:"x"`
 	}
 
+	type IQHttpUploadSlotRequest struct {
+		XMLName  xml.Name `xml:"request"`
+		Xmlns    string   `xml:"xmlns,attr"`
+		FileName string   `xml:"filename,attr"`
+		FileType string   `xml:"mime-type,attr"`
+		FileSize int64    `xml:"size,attr"`
+	}
+
 	// Created with https://github.com/miku/zek
 	type IQHttpUploadSlot struct {
 		XMLName xml.Name `xml:"slot"`
@@ -194,14 +202,22 @@ func httpUpload(client *xmpp.Client, jserver string, filePath string) string {
 		}
 	}
 
+	var request IQHttpUploadSlotRequest
+	request.Xmlns = "urn:xmpp:http:upload:0"
+	request.FileName = fileName
+	request.FileSize = fileSize
+	request.FileType = mimeType
+	r, err := xml.Marshal(request)
+	if err != nil {
+		log.Fatal(err)
+	}
+
 	// Request http upload slot
 	id = getID()
 	c = make(chan xmpp.IQ)
 	go getIQ(client, id, c)
-	_, err = client.RawInformation(client.JID(), uploadComponent, id, "get",
-		"<request xmlns='urn:xmpp:http:upload:0' filename='"+
-			fileNameEscaped.String()+"' size='"+strconv.FormatInt(fileSize, 10)+
-			"' content-type='"+mimeTypeEscaped.String()+"' />")
+	_, err = client.RawInformation(client.JID(), uploadComponent, id, "get", string(r))
+
 	if err != nil {
 		log.Fatal(err)
 	}