Skip to content
This repository has been archived by the owner on May 21, 2018. It is now read-only.

Validate against invalid control characters in interpolated strings. #268

Open
mnd999 opened this issue Mar 29, 2017 · 2 comments
Open

Validate against invalid control characters in interpolated strings. #268

mnd999 opened this issue Mar 29, 2017 · 2 comments

Comments

@mnd999
Copy link

mnd999 commented Mar 29, 2017

I hit an issue in a production system with this string using the jawn backend:

scala> json"""{"description":" �"}"""
java.util.NoSuchElementException: None.get
  at scala.None$.get(Option.scala:347)
  at scala.None$.get(Option.scala:345)
  ... 29 elided

scala> """" �"""".getBytes()
res16: Array[Byte] = Array(34, 32, 11, 34)

Some further testing was done, and this issue was definitely jawn related. Looks like it works on Json4s and Argonaut, but seems to fail for the others. Jackson actually gives a useful exception which says that the control character 11 needs to be escaped with a backslash. Jackson is right, according to RFC7159 (https://tools.ietf.org/html/rfc7159#page-8), this should be escaped.

Rapture should take a conservative stance on what is allowed inside an interpolated string. So making that a compile error would be better.

@mnd999
Copy link
Author

mnd999 commented Mar 30, 2017

This is actually worse that I thought, because you can do this:

scala> val testStr = "{\"test\":\"Hello, \\u000b\"}"
testStr: String = {"test":"Hello, \u000b"}

scala> Json.parse(testStr)
res33: rapture.json.Json = json"""{"test":"Hello, �"}"""

scala> json"""{"Hello": $res33 }"""
java.util.NoSuchElementException: None.get

@propensive
Copy link
Owner

Yeah, that's definitely a Rapture issue with the substitution. If I recall correctly, it serializes res33 to a String then substitutes it into the expression. This means that the serialization is wrong.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants