OLD | NEW |
1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/json/string_escape.h" | 5 #include "base/json/string_escape.h" |
6 | 6 |
7 #include <string> | 7 #include <string> |
8 | 8 |
9 #include "base/strings/string_util.h" | 9 #include "base/strings/string_util.h" |
10 #include "base/strings/stringprintf.h" | 10 #include "base/strings/stringprintf.h" |
11 #include "base/strings/utf_string_conversion_utils.h" | |
12 #include "base/strings/utf_string_conversions.h" | |
13 #include "base/third_party/icu/icu_utf.h" | |
14 | 11 |
15 namespace base { | 12 namespace base { |
16 | 13 |
17 namespace { | 14 namespace { |
18 | 15 |
19 // Format string for printing a \uXXXX escape sequence. | 16 // Try to escape |c| as a "SingleEscapeCharacter" (\n, etc). If successful, |
20 const char kU16EscapeFormat[] = "\\u%04X"; | 17 // returns true and appends the escape sequence to |dst|. This isn't required |
21 | 18 // by the spec, but it's more readable by humans than the \uXXXX alternatives. |
22 // The code point to output for an invalid input code unit. | 19 template<typename CHAR> |
23 const uint32 kReplacementCodePoint = 0xFFFD; | 20 static bool JsonSingleEscapeChar(const CHAR c, std::string* dst) { |
24 | |
25 // Used below in EscapeSpecialCodePoint(). | |
26 COMPILE_ASSERT('<' == 0x3C, less_than_sign_is_0x3c); | |
27 | |
28 // Try to escape the |code_point| if it is a known special character. If | |
29 // successful, returns true and appends the escape sequence to |dest|. This | |
30 // isn't required by the spec, but it's more readable by humans. | |
31 bool EscapeSpecialCodePoint(uint32 code_point, std::string* dest) { | |
32 // WARNING: if you add a new case here, you need to update the reader as well. | 21 // WARNING: if you add a new case here, you need to update the reader as well. |
33 // Note: \v is in the reader, but not here since the JSON spec doesn't | 22 // Note: \v is in the reader, but not here since the JSON spec doesn't |
34 // allow it. | 23 // allow it. |
35 switch (code_point) { | 24 switch (c) { |
36 case '\b': | 25 case '\b': |
37 dest->append("\\b"); | 26 dst->append("\\b"); |
38 break; | 27 break; |
39 case '\f': | 28 case '\f': |
40 dest->append("\\f"); | 29 dst->append("\\f"); |
41 break; | 30 break; |
42 case '\n': | 31 case '\n': |
43 dest->append("\\n"); | 32 dst->append("\\n"); |
44 break; | 33 break; |
45 case '\r': | 34 case '\r': |
46 dest->append("\\r"); | 35 dst->append("\\r"); |
47 break; | 36 break; |
48 case '\t': | 37 case '\t': |
49 dest->append("\\t"); | 38 dst->append("\\t"); |
50 break; | 39 break; |
51 case '\\': | 40 case '\\': |
52 dest->append("\\\\"); | 41 dst->append("\\\\"); |
53 break; | 42 break; |
54 case '"': | 43 case '"': |
55 dest->append("\\\""); | 44 dst->append("\\\""); |
56 break; | |
57 // Escape < to prevent script execution; escaping > is not necessary and | |
58 // not doing so save a few bytes. | |
59 case '<': | |
60 dest->append("\\u003C"); | |
61 break; | 45 break; |
62 default: | 46 default: |
63 return false; | 47 return false; |
64 } | 48 } |
65 return true; | 49 return true; |
66 } | 50 } |
67 | 51 |
68 template <typename S> | 52 template <class STR> |
69 bool EscapeJSONStringImpl(const S& str, bool put_in_quotes, std::string* dest) { | 53 void JsonDoubleQuoteT(const STR& str, |
70 bool did_replacement = false; | 54 bool put_in_quotes, |
| 55 std::string* dst) { |
| 56 if (put_in_quotes) |
| 57 dst->push_back('"'); |
71 | 58 |
72 if (put_in_quotes) | 59 for (typename STR::const_iterator it = str.begin(); it != str.end(); ++it) { |
73 dest->push_back('"'); | 60 typename ToUnsigned<typename STR::value_type>::Unsigned c = *it; |
74 | 61 if (!JsonSingleEscapeChar(c, dst)) { |
75 // Casting is necessary because ICU uses int32. Try and do so safely. | 62 if (c < 32 || c > 126 || c == '<' || c == '>') { |
76 CHECK_LE(str.length(), static_cast<size_t>(kint32max)); | 63 // 1. Escaping <, > to prevent script execution. |
77 const int32 length = static_cast<int32>(str.length()); | 64 // 2. Technically, we could also pass through c > 126 as UTF8, but this |
78 | 65 // is also optional. It would also be a pain to implement here. |
79 for (int32 i = 0; i < length; ++i) { | 66 unsigned int as_uint = static_cast<unsigned int>(c); |
80 uint32 code_point; | 67 base::StringAppendF(dst, "\\u%04X", as_uint); |
81 if (!ReadUnicodeCharacter(str.data(), length, &i, &code_point)) { | 68 } else { |
82 code_point = kReplacementCodePoint; | 69 unsigned char ascii = static_cast<unsigned char>(*it); |
83 did_replacement = true; | 70 dst->push_back(ascii); |
| 71 } |
84 } | 72 } |
85 | |
86 if (EscapeSpecialCodePoint(code_point, dest)) | |
87 continue; | |
88 | |
89 // Escape non-printing characters. | |
90 if (code_point < 32) | |
91 base::StringAppendF(dest, kU16EscapeFormat, code_point); | |
92 else | |
93 WriteUnicodeCharacter(code_point, dest); | |
94 } | 73 } |
95 | 74 |
96 if (put_in_quotes) | 75 if (put_in_quotes) |
97 dest->push_back('"'); | 76 dst->push_back('"'); |
98 | |
99 return !did_replacement; | |
100 } | 77 } |
101 | 78 |
102 } // namespace | 79 } // namespace |
103 | 80 |
104 bool EscapeJSONString(const StringPiece& str, | 81 void JsonDoubleQuote(const StringPiece& str, |
105 bool put_in_quotes, | 82 bool put_in_quotes, |
106 std::string* dest) { | 83 std::string* dst) { |
107 return EscapeJSONStringImpl(str, put_in_quotes, dest); | 84 JsonDoubleQuoteT(str, put_in_quotes, dst); |
108 } | 85 } |
109 | 86 |
110 bool EscapeJSONString(const StringPiece16& str, | 87 std::string GetDoubleQuotedJson(const StringPiece& str) { |
111 bool put_in_quotes, | 88 std::string dst; |
112 std::string* dest) { | 89 JsonDoubleQuote(str, true, &dst); |
113 return EscapeJSONStringImpl(str, put_in_quotes, dest); | 90 return dst; |
114 } | 91 } |
115 | 92 |
116 std::string GetQuotedJSONString(const StringPiece& str) { | 93 void JsonDoubleQuote(const StringPiece16& str, |
117 std::string dest; | 94 bool put_in_quotes, |
118 bool ok = EscapeJSONStringImpl(str, true, &dest); | 95 std::string* dst) { |
119 DCHECK(ok); | 96 JsonDoubleQuoteT(str, put_in_quotes, dst); |
120 return dest; | |
121 } | 97 } |
122 | 98 |
123 std::string GetQuotedJSONString(const StringPiece16& str) { | 99 std::string GetDoubleQuotedJson(const StringPiece16& str) { |
124 std::string dest; | 100 std::string dst; |
125 bool ok = EscapeJSONStringImpl(str, true, &dest); | 101 JsonDoubleQuote(str, true, &dst); |
126 DCHECK(ok); | 102 return dst; |
127 return dest; | |
128 } | |
129 | |
130 std::string EscapeBytesAsInvalidJSONString(const StringPiece& str, | |
131 bool put_in_quotes) { | |
132 std::string dest; | |
133 | |
134 if (put_in_quotes) | |
135 dest.push_back('"'); | |
136 | |
137 for (StringPiece::const_iterator it = str.begin(); it != str.end(); ++it) { | |
138 ToUnsigned<StringPiece::value_type>::Unsigned c = *it; | |
139 if (EscapeSpecialCodePoint(c, &dest)) | |
140 continue; | |
141 | |
142 if (c < 32 || c > 126) | |
143 base::StringAppendF(&dest, kU16EscapeFormat, c); | |
144 else | |
145 dest.push_back(*it); | |
146 } | |
147 | |
148 if (put_in_quotes) | |
149 dest.push_back('"'); | |
150 | |
151 return dest; | |
152 } | 103 } |
153 | 104 |
154 } // namespace base | 105 } // namespace base |
OLD | NEW |