Improved error response generation. We now keep track of the last

request read on a connection, which allows us to generate the correct
type of response in case of an error which is handled through
`handle-server-error'.

Also added code to correctly escape text that is inserted into error
messages.  This is also a first step towards preventing cross-scripting
attacks through CLASH, although most of the code still has to be audited
for unfiltered passing through of user-supplied text.

src/main/parsing.cl

@@ -232,3 +232,20 @@ the list of values.  All other entries are kept."
 		  (cons value (cdr entry))
 		  (list value (cdr entry))))
 	(push (cons key value) result))))
+
+;;; HTML escaping for error messages.
+
+;;; This is especially important to avoid cross-scripting client
+;;; attacks through our server.
+
+(defun escape-text-for-html (text)
+  (declare (type simple-string text))
+  (with-output-to-string (stream)
+    (loop for char of-type character across text
+	  do
+	  (case char
+	    (#\< (write-string "&lt;" stream))
+	    (#\> (write-string "&gt;" stream))
+	    (#\& (write-string "&amp;" stream))
+	    (#\" (write-string "&quot;" stream))
+	    (t (write-char char stream))))))