escape.go 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198
  1. // Copyright 2016 The Go Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style
  3. // license that can be found in the LICENSE file.
  4. // Copied and modified from Go 1.8 stdlib's encoding/json/#safeSet
  5. package json
  6. import (
  7. "bytes"
  8. "unicode/utf8"
  9. )
  10. // safeSet holds the value true if the ASCII character with the given array
  11. // position can be represented inside a JSON string without any further
  12. // escaping.
  13. //
  14. // All values are true except for the ASCII control characters (0-31), the
  15. // double quote ("), and the backslash character ("\").
  16. var safeSet = [utf8.RuneSelf]bool{
  17. ' ': true,
  18. '!': true,
  19. '"': false,
  20. '#': true,
  21. '$': true,
  22. '%': true,
  23. '&': true,
  24. '\'': true,
  25. '(': true,
  26. ')': true,
  27. '*': true,
  28. '+': true,
  29. ',': true,
  30. '-': true,
  31. '.': true,
  32. '/': true,
  33. '0': true,
  34. '1': true,
  35. '2': true,
  36. '3': true,
  37. '4': true,
  38. '5': true,
  39. '6': true,
  40. '7': true,
  41. '8': true,
  42. '9': true,
  43. ':': true,
  44. ';': true,
  45. '<': true,
  46. '=': true,
  47. '>': true,
  48. '?': true,
  49. '@': true,
  50. 'A': true,
  51. 'B': true,
  52. 'C': true,
  53. 'D': true,
  54. 'E': true,
  55. 'F': true,
  56. 'G': true,
  57. 'H': true,
  58. 'I': true,
  59. 'J': true,
  60. 'K': true,
  61. 'L': true,
  62. 'M': true,
  63. 'N': true,
  64. 'O': true,
  65. 'P': true,
  66. 'Q': true,
  67. 'R': true,
  68. 'S': true,
  69. 'T': true,
  70. 'U': true,
  71. 'V': true,
  72. 'W': true,
  73. 'X': true,
  74. 'Y': true,
  75. 'Z': true,
  76. '[': true,
  77. '\\': false,
  78. ']': true,
  79. '^': true,
  80. '_': true,
  81. '`': true,
  82. 'a': true,
  83. 'b': true,
  84. 'c': true,
  85. 'd': true,
  86. 'e': true,
  87. 'f': true,
  88. 'g': true,
  89. 'h': true,
  90. 'i': true,
  91. 'j': true,
  92. 'k': true,
  93. 'l': true,
  94. 'm': true,
  95. 'n': true,
  96. 'o': true,
  97. 'p': true,
  98. 'q': true,
  99. 'r': true,
  100. 's': true,
  101. 't': true,
  102. 'u': true,
  103. 'v': true,
  104. 'w': true,
  105. 'x': true,
  106. 'y': true,
  107. 'z': true,
  108. '{': true,
  109. '|': true,
  110. '}': true,
  111. '~': true,
  112. '\u007f': true,
  113. }
  114. // copied from Go 1.8 stdlib's encoding/json/#hex
  115. var hex = "0123456789abcdef"
  116. // escapeStringBytes escapes and writes the passed in string bytes to the dst
  117. // buffer
  118. //
  119. // Copied and modifed from Go 1.8 stdlib's encodeing/json/#encodeState.stringBytes
  120. func escapeStringBytes(e *bytes.Buffer, s []byte) {
  121. e.WriteByte('"')
  122. start := 0
  123. for i := 0; i < len(s); {
  124. if b := s[i]; b < utf8.RuneSelf {
  125. if safeSet[b] {
  126. i++
  127. continue
  128. }
  129. if start < i {
  130. e.Write(s[start:i])
  131. }
  132. switch b {
  133. case '\\', '"':
  134. e.WriteByte('\\')
  135. e.WriteByte(b)
  136. case '\n':
  137. e.WriteByte('\\')
  138. e.WriteByte('n')
  139. case '\r':
  140. e.WriteByte('\\')
  141. e.WriteByte('r')
  142. case '\t':
  143. e.WriteByte('\\')
  144. e.WriteByte('t')
  145. default:
  146. // This encodes bytes < 0x20 except for \t, \n and \r.
  147. // If escapeHTML is set, it also escapes <, >, and &
  148. // because they can lead to security holes when
  149. // user-controlled strings are rendered into JSON
  150. // and served to some browsers.
  151. e.WriteString(`\u00`)
  152. e.WriteByte(hex[b>>4])
  153. e.WriteByte(hex[b&0xF])
  154. }
  155. i++
  156. start = i
  157. continue
  158. }
  159. c, size := utf8.DecodeRune(s[i:])
  160. if c == utf8.RuneError && size == 1 {
  161. if start < i {
  162. e.Write(s[start:i])
  163. }
  164. e.WriteString(`\ufffd`)
  165. i += size
  166. start = i
  167. continue
  168. }
  169. // U+2028 is LINE SEPARATOR.
  170. // U+2029 is PARAGRAPH SEPARATOR.
  171. // They are both technically valid characters in JSON strings,
  172. // but don't work in JSONP, which has to be evaluated as JavaScript,
  173. // and can lead to security holes there. It is valid JSON to
  174. // escape them, so we do so unconditionally.
  175. // See http://timelessrepo.com/json-isnt-a-javascript-subset for discussion.
  176. if c == '\u2028' || c == '\u2029' {
  177. if start < i {
  178. e.Write(s[start:i])
  179. }
  180. e.WriteString(`\u202`)
  181. e.WriteByte(hex[c&0xF])
  182. i += size
  183. start = i
  184. continue
  185. }
  186. i += size
  187. }
  188. if start < len(s) {
  189. e.Write(s[start:])
  190. }
  191. e.WriteByte('"')
  192. }