[9front] libjson can print invalid json

[9front] libjson can print invalid json

[Dave MacFarlane]

print("%J", json); can print invalid json if a JSON string in the object has a quotation mark in it.

I just threw together this patch to try and escape the strings from printjson() if anyone's interested
in it.

diff 30c5296f32b87d83529d772732726891e1261c9c uncommitted
--- a/sys/src/libjson/printjson.c
+++ b/sys/src/libjson/printjson.c
@@ -52,6 +52,38 @@
 }
 
 static int
+printstring(Fmt *f, char *s)
+{
+	int slen = strlen(s);
+	int i, nq=0;
+	int r;
+	char *dup, lastq;
+	for(i = 0; i < slen; i++)
+		if (s[i] == '"') nq++;
+
+	if (nq == 0)
+		return fmtprint(f, "\"%s\"", s);
+
+	r = fmtprint(f, "\"");
+
+	dup = strdup(s);
+	lastq = -1;
+	for(i = 0; i < slen; i++){
+		if(dup[i] == '"') {
+			dup[i] = 0;
+			r += fmtprint(f, "%s\\\"", &dup[lastq+1]);
+			lastq = i;
+		}
+	}
+
+	if (lastq != slen-1)
+		r += fmtprint(f, "%s", &dup[lastq+1]);
+	r += fmtprint(f, "\"");
+	free(dup);
+	return r;
+}
+
+static int
 printjson(Fmt *f, JSON *j, int indent)
 {
 	switch(j->t){
@@ -65,7 +97,7 @@
 		return fmtprint(f, "%f", j->n);
 		break;
 	case JSONString:
-		return fmtprint(f, "\"%s\"", j->s);
+		return printstring(f, j->s);
 		break;
 	case JSONArray:
 		return printarray(f, j, indent+1);

Re: [9front] libjson can print invalid json

[ori]

Quoth Dave MacFarlane <driusan@driusan.net>:
> print("%J", json); can print invalid json if a JSON string in the object has a quotation mark in it.
> 
> I just threw together this patch to try and escape the strings from printjson() if anyone's interested
> in it.
> 
> diff 30c5296f32b87d83529d772732726891e1261c9c uncommitted
> --- a/sys/src/libjson/printjson.c
> +++ b/sys/src/libjson/printjson.c
> @@ -52,6 +52,38 @@
>  }
>  
>  static int
> +printstring(Fmt *f, char *s)
> +{
> +	int slen = strlen(s);
> +	int i, nq=0;
> +	int r;
> +	char *dup, lastq;
> +	for(i = 0; i < slen; i++)
> +		if (s[i] == '"') nq++;
> +
> +	if (nq == 0)
> +		return fmtprint(f, "\"%s\"", s);
> +
> +	r = fmtprint(f, "\"");
> +
> +	dup = strdup(s);
> +	lastq = -1;
> +	for(i = 0; i < slen; i++){
> +		if(dup[i] == '"') {
> +			dup[i] = 0;
> +			r += fmtprint(f, "%s\\\"", &dup[lastq+1]);
> +			lastq = i;
> +		}
> +	}
> +
> +	if (lastq != slen-1)
> +		r += fmtprint(f, "%s", &dup[lastq+1]);
> +	r += fmtprint(f, "\"");
> +	free(dup);
> +	return r;
> +}
> +

I think we have a problem with more than just quotes; we're
not allowed any control characters, and we need to escape '\';

how's something like this (untested)?


	static int
	printstring(Fmt *f, char *s)
	{
		int n;
	
		n = 0;
		for(; *s; s++){
			switch(*s){
			case '\\':	n += fmtstrcpy(f, "\\\\");	break;
			case '\f':	n += fmtstrcpy(f, "\\f");	break;
			case '\b':	n += fmtstrcpy(f, "\\b");	break;
			case '\n':	n += fmtstrcpy(f, "\\n");	break;
			case '\r':	n += fmtstrcpy(f, "\\r");	break;
			case '\"':	n += fmtstrcpy(f, "\\\"");	break;
			default:
				if(*s < 0x20)
					n += fmtprint(f, "\\u%04x", *s);
				else
					n += fmtrune(f, *s);
			}
		}
		return n;
	}

Re: [9front] libjson can print invalid json

[Dave MacFarlane]

It certainly looks more elegant than my code, but when I tested it it's missing the
beginning and ending quote character of the json string.

After I added them, it passed the tests I wrote for my code.

static int
printstring(Fmt *f, char *s)
{
	int n;
	
	n = fmtrune(f, '"');
	for(; *s; s++){
		switch(*s){
		case '\\':	n += fmtstrcpy(f, "\\\\");	break;
		case '\f':	n += fmtstrcpy(f, "\\f");	break;
		case '\b':	n += fmtstrcpy(f, "\\b");	break;
		case '\n':	n += fmtstrcpy(f, "\\n");	break;
		case '\r':	n += fmtstrcpy(f, "\\r");	break;
		case '\"':	n += fmtstrcpy(f, "\\\"");	break;
		default:
			if(*s < 0x20)
				n += fmtprint(f, "\\u%04x", *s);
			else
				n += fmtrune(f, *s);
		}
	}
	n = fmtrune(f, '"');
	return n;
}

Here's what I used to test it:

#include <u.h>
#include <libc.h>
#include <json.h>

void testJSON(char *s) {
	print("%s\n", s);
	JSON *j = jsonparse(s);
	print("%J\n", j);
	char *str = smprint("%J", j);
	assert(jsonparse(str) != nil);
	free(j);
	free(str);
}
void main(void) {
	JSON *j;
	char *str;

	JSONfmtinstall();

	testJSON("{\"abc\": \"\"}");
	testJSON("{\"abc\": \"hello\"}");
	testJSON("{\"abc\": \"\\\"hello\"}");
	testJSON("{\"abc\": \"hello\\\"\"}");
	testJSON("{\"abc\": \"he\\\"llo\"}");
	testJSON("{\"abc\": \"\\\"he\\\"llo\\\"\"}");
	testJSON("{\"abc\": \"hello\\t\"}");
	exits("");
}

Re: [9front] libjson can print invalid json

[Dave MacFarlane]

I was curious about keys and it looks like there's also a bug
where they're not being properly escaped. Here's a diff that
fixes that as well.

cpu% git/diff .
diff 30c5296f32b87d83529d772732726891e1261c9c uncommitted
--- a/sys/src/libjson/printjson.c
+++ b/sys/src/libjson/printjson.c
@@ -7,6 +7,32 @@
 static int printobject(Fmt*, JSON*, int);
 
 static int
+printstring(Fmt *f, char *s)
+{
+	int n;
+	
+	n = fmtrune(f, '"');
+	for(; *s; s++){
+		switch(*s){
+		case '\\':	n += fmtstrcpy(f, "\\\\");	break;
+		case '\f':	n += fmtstrcpy(f, "\\f");	break;
+		case '\b':	n += fmtstrcpy(f, "\\b");	break;
+		case '\n':	n += fmtstrcpy(f, "\\n");	break;
+		case '\r':	n += fmtstrcpy(f, "\\r");	break;
+		case '\"':	n += fmtstrcpy(f, "\\\"");	break;
+		default:
+
+			if(*s < 0x20)
+				n += fmtprint(f, "\\u%04x", *s);
+			else
+				n += fmtrune(f, *s);
+		}
+	}
+	n = fmtrune(f, '"');
+	return n;
+}
+
+static int
 printarray(Fmt *f, JSON *j, int indent)
 {
 	JSONEl *jl;
@@ -41,7 +67,8 @@
 	for(jl = j->first; jl != nil; jl = jl->next){
 		for(i = 0; i < indent; i++)
 			fmtprint(f, "\t");
-		r += fmtprint(f, "\"%s\": ", jl->name);
+		r += printstring(f, jl->name);
+		r += fmtprint(f, ": ");
 		r += printjson(f, jl->val, indent);
 		r += fmtprint(f, "%s\n", jl->next != nil ? "," : "");
 	}
@@ -65,7 +92,7 @@
 		return fmtprint(f, "%f", j->n);
 		break;
 	case JSONString:
-		return fmtprint(f, "\"%s\"", j->s);
+		return printstring(f, j->s);
 		break;
 	case JSONArray:
 		return printarray(f, j, indent+1);