mirror of
https://github.com/gin-gonic/gin.git
synced 2026-09-04 14:49:27 +08:00
AsciiJSON escaped every non-ASCII rune with fmt.Appendf(buf, "\u%04x", r), but %04x is a minimum width, not a fixed width. Runes outside the Basic Multilingual Plane (e.g. emoji) need 5+ hex digits, so a single malformed \uXXXXX token was written instead of a valid 4-digit JSON \u escape. The output stayed syntactically valid JSON, so this was easy to miss, but a decoder reads the first 4 hex digits as one character and treats the rest as literal text, corrupting the value silently. RFC 8259 §7 requires code points outside the BMP to be encoded as a UTF-16 surrogate pair. Use unicode/utf16.EncodeRune to produce the pair for those runes while keeping the existing single-escape path for BMP characters. Fixes #4688
204 lines
5.3 KiB
Go
204 lines
5.3 KiB
Go
// Copyright 2014 Manu Martinez-Almeida. All rights reserved.
|
|
// Use of this source code is governed by a MIT style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package render
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"html/template"
|
|
"net/http"
|
|
"unicode"
|
|
"unicode/utf16"
|
|
|
|
"github.com/gin-gonic/gin/codec/json"
|
|
"github.com/gin-gonic/gin/internal/bytesconv"
|
|
)
|
|
|
|
// JSON contains the given interface object.
|
|
type JSON struct {
|
|
Data any
|
|
}
|
|
|
|
// IndentedJSON contains the given interface object.
|
|
type IndentedJSON struct {
|
|
Data any
|
|
}
|
|
|
|
// SecureJSON contains the given interface object and its prefix.
|
|
type SecureJSON struct {
|
|
Prefix string
|
|
Data any
|
|
}
|
|
|
|
// JsonpJSON contains the given interface object its callback.
|
|
type JsonpJSON struct {
|
|
Callback string
|
|
Data any
|
|
}
|
|
|
|
// AsciiJSON contains the given interface object.
|
|
type AsciiJSON struct {
|
|
Data any
|
|
}
|
|
|
|
// PureJSON contains the given interface object.
|
|
type PureJSON struct {
|
|
Data any
|
|
}
|
|
|
|
var (
|
|
jsonContentType = []string{"application/json; charset=utf-8"}
|
|
jsonpContentType = []string{"application/javascript; charset=utf-8"}
|
|
jsonASCIIContentType = []string{"application/json"}
|
|
)
|
|
|
|
// Render (JSON) writes data with custom ContentType.
|
|
func (r JSON) Render(w http.ResponseWriter) error {
|
|
return WriteJSON(w, r.Data)
|
|
}
|
|
|
|
// WriteContentType (JSON) writes JSON ContentType.
|
|
func (r JSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonContentType)
|
|
}
|
|
|
|
// WriteJSON marshals the given interface object and writes it with custom ContentType.
|
|
func WriteJSON(w http.ResponseWriter, obj any) error {
|
|
writeContentType(w, jsonContentType)
|
|
jsonBytes, err := json.API.Marshal(obj)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(jsonBytes)
|
|
return err
|
|
}
|
|
|
|
// Render (IndentedJSON) marshals the given interface object and writes it with custom ContentType.
|
|
func (r IndentedJSON) Render(w http.ResponseWriter) error {
|
|
r.WriteContentType(w)
|
|
jsonBytes, err := json.API.MarshalIndent(r.Data, "", " ")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(jsonBytes)
|
|
return err
|
|
}
|
|
|
|
// WriteContentType (IndentedJSON) writes JSON ContentType.
|
|
func (r IndentedJSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonContentType)
|
|
}
|
|
|
|
// Render (SecureJSON) marshals the given interface object and writes it with custom ContentType.
|
|
func (r SecureJSON) Render(w http.ResponseWriter) error {
|
|
r.WriteContentType(w)
|
|
jsonBytes, err := json.API.Marshal(r.Data)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// if the jsonBytes is array values
|
|
if bytes.HasPrefix(jsonBytes, bytesconv.StringToBytes("[")) && bytes.HasSuffix(jsonBytes,
|
|
bytesconv.StringToBytes("]")) {
|
|
if _, err = w.Write(bytesconv.StringToBytes(r.Prefix)); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
_, err = w.Write(jsonBytes)
|
|
return err
|
|
}
|
|
|
|
// WriteContentType (SecureJSON) writes JSON ContentType.
|
|
func (r SecureJSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonContentType)
|
|
}
|
|
|
|
// Render (JsonpJSON) marshals the given interface object and writes it and its callback with custom ContentType.
|
|
func (r JsonpJSON) Render(w http.ResponseWriter) (err error) {
|
|
r.WriteContentType(w)
|
|
ret, err := json.API.Marshal(r.Data)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if r.Callback == "" {
|
|
_, err = w.Write(ret)
|
|
return err
|
|
}
|
|
|
|
callback := template.JSEscapeString(r.Callback)
|
|
if _, err = w.Write(bytesconv.StringToBytes(callback)); err != nil {
|
|
return err
|
|
}
|
|
|
|
if _, err = w.Write(bytesconv.StringToBytes("(")); err != nil {
|
|
return err
|
|
}
|
|
|
|
if _, err = w.Write(ret); err != nil {
|
|
return err
|
|
}
|
|
|
|
if _, err = w.Write(bytesconv.StringToBytes(");")); err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// WriteContentType (JsonpJSON) writes Javascript ContentType.
|
|
func (r JsonpJSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonpContentType)
|
|
}
|
|
|
|
// Render (AsciiJSON) marshals the given interface object and writes it with custom ContentType.
|
|
func (r AsciiJSON) Render(w http.ResponseWriter) error {
|
|
r.WriteContentType(w)
|
|
ret, err := json.API.Marshal(r.Data)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
var buffer bytes.Buffer
|
|
escapeBuf := make([]byte, 0, 12) // Preallocate 12 bytes: worst case is a \uXXXX\uXXXX surrogate pair
|
|
|
|
for _, r := range bytesconv.BytesToString(ret) {
|
|
switch {
|
|
case r <= unicode.MaxASCII:
|
|
buffer.WriteByte(byte(r))
|
|
case r <= 0xFFFF:
|
|
escapeBuf = fmt.Appendf(escapeBuf[:0], "\\u%04x", r) // Reuse escapeBuf
|
|
buffer.Write(escapeBuf)
|
|
default:
|
|
// Code points outside the Basic Multilingual Plane don't fit in a
|
|
// single 4-hex-digit \u escape; RFC 8259 §7 requires encoding them
|
|
// as a UTF-16 surrogate pair instead.
|
|
r1, r2 := utf16.EncodeRune(r)
|
|
escapeBuf = fmt.Appendf(escapeBuf[:0], "\\u%04x\\u%04x", r1, r2)
|
|
buffer.Write(escapeBuf)
|
|
}
|
|
}
|
|
|
|
_, err = w.Write(buffer.Bytes())
|
|
return err
|
|
}
|
|
|
|
// WriteContentType (AsciiJSON) writes JSON ContentType.
|
|
func (r AsciiJSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonASCIIContentType)
|
|
}
|
|
|
|
// Render (PureJSON) writes custom ContentType and encodes the given interface object.
|
|
func (r PureJSON) Render(w http.ResponseWriter) error {
|
|
r.WriteContentType(w)
|
|
encoder := json.API.NewEncoder(w)
|
|
encoder.SetEscapeHTML(false)
|
|
return encoder.Encode(r.Data)
|
|
}
|
|
|
|
// WriteContentType (PureJSON) writes custom ContentType.
|
|
func (r PureJSON) WriteContentType(w http.ResponseWriter) {
|
|
writeContentType(w, jsonContentType)
|
|
}
|