Skip to content
This repository has been archived by the owner on Jan 30, 2019. It is now read-only.

JS_ESCAPE_MAP is incomplete and causes invalid JSON output #41

Open
scomma opened this issue Jun 3, 2013 · 0 comments
Open

JS_ESCAPE_MAP is incomplete and causes invalid JSON output #41

scomma opened this issue Jun 3, 2013 · 0 comments

Comments

@scomma
Copy link

scomma commented Jun 3, 2013

There are a bunch of control characters which users routinely enter such as "\v", "\f", "\u0003" and even "\b" which json_builder fails to escape resulting in an invalid output that both JSON.parse and browsers' JSON library choke on.

[413] pry(main)> "\n".to_json
=> "\"\\n\""
[414] pry(main)> "\n".to_builder
=> "\"\\n\""
[415] pry(main)> "\b".to_json
=> "\"\\b\""
[416] pry(main)> "\b".to_builder
=> "\"\b\""
[417] pry(main)> JSON.parse '{"x": %s}' % _
JSON::ParserError: 757: unexpected token at '{"x": "}'
from /Users/alpha/.rbenv/versions/1.9.3-p362/lib/ruby/gems/1.9.1/gems/json-1.7.7/lib/json/common.rb:155:in `parse'

Right now our only workaround is to sanitize user input.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant