- Fix that quotation and escaping works the same in auth-zone

url content, as in the zonefile read. Thanks to Qifan Zhang,
  Palo Alto Networks for the report.

doc/Changelog

@@ -11,6 +11,9 @@
 	  Polytechnical University, for the report.
 	- Fix parse of svcbparam ech, it had incorrect length. Thanks
 	  to Qifan Zhang, Palo Alto Networks for the report.
+	- Fix that quotation and escaping works the same in auth-zone
+	  url content, as in the zonefile read. Thanks to Qifan Zhang,
+	  Palo Alto Networks for the report.
 
 3 June 2026: Yorgos
 	- Fix const as reported by newest compiler warnings.

services/authzone.c

@@ -4462,29 +4462,31 @@ chunkline_get_line(struct auth_chunk** chunk, size_t* chunk_pos,
 }
 
 /** count number of open and closed parenthesis in a chunkline */
-static int
+int
 chunkline_count_parens(sldns_buffer* buf, size_t start)
 {
 	size_t end = sldns_buffer_position(buf);
 	size_t i;
 	int count = 0;
-	int squote = 0, dquote = 0;
+	int dquote = 0;
+	char prev_c = 0;
 	for(i=start; i<end; i++) {
 		char c = (char)sldns_buffer_read_u8_at(buf, i);
-		if(squote && c != '\'') continue;
-		if(dquote && c != '"') continue;
-		if(c == '"')
+		if(dquote && !(c == '"' && prev_c != '\\')) {
+			prev_c = (prev_c == '\\' && c == '\\') ? 0 : c;
+			continue;
+		}
+		if(c == '"' && prev_c != '\\')
 			dquote = !dquote; /* skip quoted part */
-		else if(c == '\'')
-			squote = !squote; /* skip quoted part */
-		else if(c == '(')
+		else if(c == '(' && prev_c != '\\')
 			count ++;
-		else if(c == ')')
+		else if(c == ')' && prev_c != '\\')
 			count --;
-		else if(c == ';') {
+		else if(c == ';' && prev_c != '\\') {
 			/* rest is a comment */
 			return count;
 		}
+		prev_c = (prev_c == '\\' && c == '\\') ? 0 : c;
 	}
 	return count;
 }
@@ -4495,20 +4497,22 @@ chunkline_remove_trailcomment(sldns_buffer* buf, size_t start)
 {
 	size_t end = sldns_buffer_position(buf);
 	size_t i;
-	int squote = 0, dquote = 0;
+	int dquote = 0;
+	char prev_c = 0;
 	for(i=start; i<end; i++) {
 		char c = (char)sldns_buffer_read_u8_at(buf, i);
-		if(squote && c != '\'') continue;
-		if(dquote && c != '"') continue;
-		if(c == '"')
+		if(dquote && !(c == '"' && prev_c != '\\')) {
+			prev_c = (prev_c == '\\' && c == '\\') ? 0 : c;
+			continue;
+		}
+		if(c == '"' && prev_c != '\\')
 			dquote = !dquote; /* skip quoted part */
-		else if(c == '\'')
-			squote = !squote; /* skip quoted part */
-		else if(c == ';') {
+		else if(c == ';' && prev_c != '\\') {
 			/* rest is a comment */
 			sldns_buffer_set_position(buf, i);
 			return;
 		}
+		prev_c = (prev_c == '\\' && c == '\\') ? 0 : c;
 	}
 	/* nothing to remove */
 }

services/authzone.h

@@ -828,4 +828,7 @@ void auth_xfer_delete(struct auth_xfer* xfr);
  */
 void xfr_disown_tasks(struct auth_xfer* xfr, struct worker* worker);
 
+/** count number of open and closed parenthesis in a chunkline */
+int chunkline_count_parens(struct sldns_buffer* buf, size_t start);
+
 #endif /* SERVICES_AUTHZONE_H */

testcode/unitauth.c

@@ -1027,6 +1027,38 @@ authzone_query_test(void)
 	check_queries("example.com", zone_example_com, example_com_queries);
 }
 
+/** Test chunkline_count_parens output */
+static void
+authzone_chunkline_count_parens_test(void)
+{
+	sldns_buffer* buf;
+	if(vbmp) printf("Testing chunkline_count_parens\n");
+	buf = sldns_buffer_new(1024);
+	if(!buf) fatal_exit("out of memory");
+
+	/* Check that escaped characters are handled, '\x', and in quotes. */
+	sldns_buffer_printf(buf, "TXT \"x\" \\(");
+	unit_assert(chunkline_count_parens(buf, 0) == 0);
+
+	sldns_buffer_clear(buf);
+	sldns_buffer_printf(buf, "TXT ';x' (");
+	unit_assert(chunkline_count_parens(buf, 0) == 0);
+
+	sldns_buffer_clear(buf);
+	sldns_buffer_printf(buf, "TXT \"a;b\" (");
+	unit_assert(chunkline_count_parens(buf, 0) == 1);
+
+	sldns_buffer_clear(buf);
+	sldns_buffer_printf(buf, "TXT \\) )");
+	unit_assert(chunkline_count_parens(buf, 0) == -1);
+
+	sldns_buffer_clear(buf);
+	sldns_buffer_printf(buf, "TXT \"a\\\\\" \"(\" ");
+	unit_assert(chunkline_count_parens(buf, 0) == 0);
+
+	sldns_buffer_free(buf);
+}
+
 /** test authzone code */
 void 
 authzone_test(void)
@@ -1036,4 +1068,5 @@ authzone_test(void)
 	authzone_compare_serial();
 	authzone_read_test();
 	authzone_query_test();
+	authzone_chunkline_count_parens_test();
 }