[Qemu-devel] [PATCH] json: escape u0000 .. u001F when outputting json

[Qemu-devel] [PATCH] json: escape u0000 .. u001F when outputting json

[Anthony Liguori]

Markus Armbruster pointed out:

JSON requires control characters in strings to be escaped.  RFC 4627
section 2.5:

   A string begins and ends with quotation marks.  All Unicode
   characters may be placed within the quotation marks except for the
   characters that must be escaped: quotation mark, reverse solidus, and
   the control characters (U+0000 through U+001F).

We've been quoting the special escape sequences that JSON defines but we
haven't been encoding the full control character range.  This patch fixes that.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
---
 qjson.c |   10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/qjson.c b/qjson.c
index 60c904d..9ad8a91 100644
--- a/qjson.c
+++ b/qjson.c
@@ -163,8 +163,14 @@ static void to_json(const QObject *obj, QString *str)
                     qstring_append(str, "\\t");
                     break;
                 default: {
-                    char buf[2] = { ptr[0], 0 };
-                    qstring_append(str, buf);
+                    if (ptr[0] <= 0x1F) {
+                        char escape[7];
+                        snprintf(escape, sizeof(escape), "\\u%04X", ptr[0]);
+                        qstring_append(str, escape);
+                    } else {
+                        char buf[2] = { ptr[0], 0 };
+                        qstring_append(str, buf);
+                    }
                     break;
                 }
                 }
-- 
1.6.5.2

[Qemu-devel] Re: [PATCH] json: escape u0000 .. u001F when outputting json

[Markus Armbruster]

Anthony Liguori <aliguori@us.ibm.com> writes:

> Markus Armbruster pointed out:
>
> JSON requires control characters in strings to be escaped.  RFC 4627
> section 2.5:
>
>    A string begins and ends with quotation marks.  All Unicode
>    characters may be placed within the quotation marks except for the
>    characters that must be escaped: quotation mark, reverse solidus, and
>    the control characters (U+0000 through U+001F).
>
> We've been quoting the special escape sequences that JSON defines but we
> haven't been encoding the full control character range.  This patch fixes that.

Looks good.