Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-12-08 06:10:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

json: escape < and > in any JSON string.

Browse source 
Angle brackets can trigger some browser sniffers, causing
some forms of JSON output to be interpreted as HTML.
Escaping angle brackets closes that security hole.

R=rsc
CC=golang-dev
https://golang.org/cl/4701047
This commit is contained in:
David Symonds 2011-07-14 13:30:08 +10:00
parent fc1f0bd5e9
commit cbad580e9c
2 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/pkg/json/decode_test.go
View file

@ -208,6 +208,18 @@ func TestUnmarshalPtrPtr(t *testing.T) {
}
}
func TestEscape(t *testing.T) {
const input = `"foobar"<html>`
const expected = `"\"foobar\"\u003chtml\u003e"`
b, err := Marshal(input)
if err != nil {
t.Fatalf("Marshal error: %v", err)
}
if s := string(b); s != expected {
t.Errorf("Encoding of [%s] was [%s], want [%s]", input, s, expected)
}
}
func TestHTMLEscape(t *testing.T) {
b, err := MarshalForHTML("foobarbaz<>&quux")
if err != nil {