escape suggest response.

src/main/java/org/codelibs/fess/api/json/JsonApiManager.java

@@ -585,11 +585,11 @@ public class JsonApiManager extends BaseApiManager {
 
     }
 
-    protected static String escapeCallbackName(final String callbackName) {
+    public static String escapeCallbackName(final String callbackName) {
         return "/**/" + callbackName.replaceAll("[^0-9a-zA-Z_\\$\\.]", StringUtil.EMPTY);
     }
 
-    protected static String escapeJson(final Object obj) {
+    public static String escapeJson(final Object obj) {
         if (obj == null) {
             return "null";
         }
@@ -630,7 +630,7 @@ public class JsonApiManager extends BaseApiManager {
         return buf.toString();
     }
 
-    protected static String escapeJsonString(final String str) {
+    public static String escapeJsonString(final String str) {
 
         final StringBuilder out = new StringBuilder(str.length() * 2);
         int sz;

src/main/java/org/codelibs/fess/api/suggest/SuggestApiManager.java

@@ -104,13 +104,13 @@ public class SuggestApiManager extends BaseApiManager {
                     }
                     first = false;
 
-                    buf.append("{\"text\":\"").append(item.getText()).append('\"');
+                    buf.append("{\"text\":\"").append(JsonApiManager.escapeJsonString(item.getText())).append('\"');
                     buf.append(",\"tags\":[");
                     for (int i = 0; i < item.getTags().length; i++) {
                         if (i > 0) {
                             buf.append(',');
                         }
-                        buf.append('\"').append(item.getTags()[i]).append('\"');
+                        buf.append('\"').append(JsonApiManager.escapeJsonString(item.getTags()[i])).append('\"');
                     }
                     buf.append(']');
 
@@ -119,7 +119,7 @@ public class SuggestApiManager extends BaseApiManager {
                         if (i > 0) {
                             buf.append(',');
                         }
-                        buf.append('\"').append(item.getRoles()[i]).append('\"');
+                        buf.append('\"').append(JsonApiManager.escapeJsonString(item.getRoles()[i])).append('\"');
                     }
                     buf.append(']');
 
@@ -128,7 +128,7 @@ public class SuggestApiManager extends BaseApiManager {
                         if (i > 0) {
                             buf.append(',');
                         }
-                        buf.append('\"').append(item.getFields()[i]).append('\"');
+                        buf.append('\"').append(JsonApiManager.escapeJsonString(item.getFields()[i])).append('\"');
                     }
                     buf.append(']');