mirror of
https://github.com/gin-gonic/gin.git
synced 2026-09-04 22:53:34 +08:00
AsciiJSON.Render used fmt.Appendf(buf, "\\u%04x", r) for all non-ASCII runes. The %04x format is a *minimum* width, not a fixed width, so runes above U+FFFF (emoji, musical symbols, supplementary CJK, etc.) produce a 5-digit escape like \u1f600. JSON \u escapes are always exactly 4 hex digits (RFC 8259 §7), so a decoder reads the first 4 digits as a different character and treats the remaining digit(s) as literal text. The output is still syntactically valid JSON, which makes the corruption easy to miss — values silently fail to round-trip. Fix: detect runes > U+FFFF and split them into a UTF-16 surrogate pair (\uHHHH\uLLLL) before writing the escape. BMP characters continue to use the single-escape path unchanged. Add TestRenderAsciiJSONNonBMP to verify correct surrogate-pair encoding and full round-trip fidelity for 😀 (U+1F600), 𝄞 (U+1D11E), and 𠀀 (U+20000). Fixes #4688 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
205 lines
5.3 KiB
Go
205 lines
5.3 KiB
Go
// Copyright 2014 Manu Martinez-Almeida. All rights reserved.
|
|
// Use of this source code is governed by a MIT style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package render
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"html/template"
|
|
"net/http"
|
|
"unicode"
|
|
|
|
"github.com/gin-gonic/gin/codec/json"
|
|
"github.com/gin-gonic/gin/internal/bytesconv"
|
|
)
|
|
|
|
// JSON contains the given interface object.
|
|
type JSON struct {
|
|
Data any
|
|
}
|
|
|
|
// IndentedJSON contains the given interface object.
|
|
type IndentedJSON struct {
|
|
Data any
|
|
}
|
|
|
|
// SecureJSON contains the given interface object and its prefix.
|
|
type SecureJSON struct {
|
|
Prefix string
|
|
Data any
|
|
}
|
|
|
|
// JsonpJSON contains the given interface object its callback.
|
|
type JsonpJSON struct {
|
|
Callback string
|
|
Data any
|
|
}
|
|
|
|
// AsciiJSON contains the given interface object.
|
|
type AsciiJSON struct {
|
|
Data any
|
|
}
|
|
|
|
// PureJSON contains the given interface object.
|
|
type PureJSON struct {
|
|
Data any
|
|
}
|
|
|
|
var (
|
|
jsonContentType = []string{"application/json; charset=utf-8"}
|
|
jsonpContentType = []string{"application/javascript; charset=utf-8"}
|
|
jsonASCIIContentType = []string{"application/json"}
|
|
)
|
|
|
|
// Render (JSON) writes data with custom ContentType.
|
|
func (r JSON) Render(w http.ResponseWriter) error {
|
|
return WriteJSON(w, r.Data)
|
|
}
|
|
|
|
// WriteContentType (JSON) writes JSON ContentType.
|
|
func (r JSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonContentType)
|
|
}
|
|
|
|
// WriteJSON marshals the given interface object and writes it with custom ContentType.
|
|
func WriteJSON(w http.ResponseWriter, obj any) error {
|
|
writeContentType(w, jsonContentType)
|
|
jsonBytes, err := json.API.Marshal(obj)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(jsonBytes)
|
|
return err
|
|
}
|
|
|
|
// Render (IndentedJSON) marshals the given interface object and writes it with custom ContentType.
|
|
func (r IndentedJSON) Render(w http.ResponseWriter) error {
|
|
r.WriteContentType(w)
|
|
jsonBytes, err := json.API.MarshalIndent(r.Data, "", " ")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(jsonBytes)
|
|
return err
|
|
}
|
|
|
|
// WriteContentType (IndentedJSON) writes JSON ContentType.
|
|
func (r IndentedJSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonContentType)
|
|
}
|
|
|
|
// Render (SecureJSON) marshals the given interface object and writes it with custom ContentType.
|
|
func (r SecureJSON) Render(w http.ResponseWriter) error {
|
|
r.WriteContentType(w)
|
|
jsonBytes, err := json.API.Marshal(r.Data)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// if the jsonBytes is array values
|
|
if bytes.HasPrefix(jsonBytes, bytesconv.StringToBytes("[")) && bytes.HasSuffix(jsonBytes,
|
|
bytesconv.StringToBytes("]")) {
|
|
if _, err = w.Write(bytesconv.StringToBytes(r.Prefix)); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
_, err = w.Write(jsonBytes)
|
|
return err
|
|
}
|
|
|
|
// WriteContentType (SecureJSON) writes JSON ContentType.
|
|
func (r SecureJSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonContentType)
|
|
}
|
|
|
|
// Render (JsonpJSON) marshals the given interface object and writes it and its callback with custom ContentType.
|
|
func (r JsonpJSON) Render(w http.ResponseWriter) (err error) {
|
|
r.WriteContentType(w)
|
|
ret, err := json.API.Marshal(r.Data)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if r.Callback == "" {
|
|
_, err = w.Write(ret)
|
|
return err
|
|
}
|
|
|
|
callback := template.JSEscapeString(r.Callback)
|
|
if _, err = w.Write(bytesconv.StringToBytes(callback)); err != nil {
|
|
return err
|
|
}
|
|
|
|
if _, err = w.Write(bytesconv.StringToBytes("(")); err != nil {
|
|
return err
|
|
}
|
|
|
|
if _, err = w.Write(ret); err != nil {
|
|
return err
|
|
}
|
|
|
|
if _, err = w.Write(bytesconv.StringToBytes(");")); err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// WriteContentType (JsonpJSON) writes Javascript ContentType.
|
|
func (r JsonpJSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonpContentType)
|
|
}
|
|
|
|
// Render (AsciiJSON) marshals the given interface object and writes it with custom ContentType.
|
|
func (r AsciiJSON) Render(w http.ResponseWriter) error {
|
|
r.WriteContentType(w)
|
|
ret, err := json.API.Marshal(r.Data)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
var buffer bytes.Buffer
|
|
escapeBuf := make([]byte, 0, 12) // 12 bytes for a UTF-16 surrogate pair (\uHHHH\uLLLL)
|
|
|
|
for _, r := range bytesconv.BytesToString(ret) {
|
|
if r > unicode.MaxASCII {
|
|
if r > 0xFFFF {
|
|
// Non-BMP character: encode as a UTF-16 surrogate pair per RFC 8259 §7.
|
|
// \u alone cannot represent code points above U+FFFF (it is always 4 hex digits),
|
|
// so we split the rune into a high surrogate and a low surrogate.
|
|
r -= 0x10000
|
|
high := 0xD800 + (r>>10)&0x3FF
|
|
low := 0xDC00 + r&0x3FF
|
|
escapeBuf = fmt.Appendf(escapeBuf[:0], "\\u%04x\\u%04x", high, low)
|
|
} else {
|
|
escapeBuf = fmt.Appendf(escapeBuf[:0], "\\u%04x", r)
|
|
}
|
|
buffer.Write(escapeBuf)
|
|
} else {
|
|
buffer.WriteByte(byte(r))
|
|
}
|
|
}
|
|
|
|
_, err = w.Write(buffer.Bytes())
|
|
return err
|
|
}
|
|
|
|
// WriteContentType (AsciiJSON) writes JSON ContentType.
|
|
func (r AsciiJSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonASCIIContentType)
|
|
}
|
|
|
|
// Render (PureJSON) writes custom ContentType and encodes the given interface object.
|
|
func (r PureJSON) Render(w http.ResponseWriter) error {
|
|
r.WriteContentType(w)
|
|
encoder := json.API.NewEncoder(w)
|
|
encoder.SetEscapeHTML(false)
|
|
return encoder.Encode(r.Data)
|
|
}
|
|
|
|
// WriteContentType (PureJSON) writes custom ContentType.
|
|
func (r PureJSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonContentType)
|
|
}
|