json: escape < and > in any JSON string.

Angle brackets can trigger some browser sniffers, causing some forms of JSON output to be interpreted as HTML. Escaping angle brackets closes that security hole. R=rsc CC=golang-dev https://golang.org/cl/4701047

json: escape < and > in any JSON string.
Angle brackets can trigger some browser sniffers, causing some forms of JSON output to be interpreted as HTML. Escaping angle brackets closes that security hole. R=rsc CC=golang-dev https://golang.org/cl/4701047
cbad580e · David Symonds · fc1f0bd5 · cbad580e · cbad580e
Commit cbad580e authored Jul 14, 2011 by David Symonds
Hide whitespace changes
Inline Side-by-side

Showing with 17 additions and 1 deletion

src/pkg/json/decode_test.go src/pkg/json/decode_test.go +12 -0

src/pkg/json/encode.go src/pkg/json/encode.go +5 -1

No files found.
--- a/src/pkg/json/decode_test.go
+++ b/src/pkg/json/decode_test.go
@@ -208,6 +208,18 @@ func TestUnmarshalPtrPtr(t *testing.T) {
 	}
 }

+func TestEscape(t *testing.T) {
+	const input = `"foobar"<html>`
+	const expected = `"\"foobar\"\u003chtml\u003e"`
+	b, err := Marshal(input)
+	if err != nil {
+		t.Fatalf("Marshal error: %v", err)
+	}
+	if s := string(b); s != expected {
+		t.Errorf("Encoding of [%s] was [%s], want [%s]", input, s, expected)
+	}
+}
+
 func TestHTMLEscape(t *testing.T) {
 	b, err := MarshalForHTML("foobarbaz<>&quux")
 	if err != nil {

--- a/src/pkg/json/encode.go
+++ b/src/pkg/json/encode.go
@@ -337,7 +337,7 @@ func (e *encodeState) string(s string) {
 	start := 0
 	for i := 0; i < len(s); {
 		if b := s[i]; b < utf8.RuneSelf {
-			if 0x20 <= b && b != '\\' && b != '"' {
+			if 0x20 <= b && b != '\\' && b != '"' && b != '<' && b != '>' {
 				i++
 				continue
 			}
@@ -355,6 +355,10 @@ func (e *encodeState) string(s string) {
 				e.WriteByte('\\')
 				e.WriteByte('r')
 			default:
+				// This encodes bytes < 0x20 except for \n and \r,
+				// as well as < and >. The latter are escaped because they
+				// can lead to security holes when user-controlled strings
+				// are rendered into JSON and served to some browsers.
 				e.WriteString(`\u00`)
 				e.WriteByte(hex[b>>4])
 				e.WriteByte(hex[b&0xF])