diff options
author | webchick <webchick@24967.no-reply.drupal.org> | 2011-12-11 00:18:13 -0600 |
---|---|---|
committer | webchick <webchick@24967.no-reply.drupal.org> | 2011-12-11 00:18:13 -0600 |
commit | 6fcc87bf4e930d073c67f676131bba65008a79c5 (patch) | |
tree | 9b49f11a84ebc2032d37504beabc157d1e379612 /includes | |
parent | 11d884bee7d0e00ede4cc0c3c147d787292b9b29 (diff) | |
download | brdo-6fcc87bf4e930d073c67f676131bba65008a79c5.tar.gz brdo-6fcc87bf4e930d073c67f676131bba65008a79c5.tar.bz2 |
Issue #479368 by Heine, Roger Saner, xjm, mcarbone, keichee, asimmonds: Fixed Create RFC compliant HTML safe JSON.
Diffstat (limited to 'includes')
-rw-r--r-- | includes/common.inc | 21 | ||||
-rw-r--r-- | includes/json-encode.inc | 102 |
2 files changed, 120 insertions, 3 deletions
diff --git a/includes/common.inc b/includes/common.inc index f95597f87..6cdd22bde 100644 --- a/includes/common.inc +++ b/includes/common.inc @@ -4804,14 +4804,29 @@ function drupal_clear_js_cache() { /** * Converts a PHP variable into its JavaScript equivalent. * - * We use HTML-safe strings, i.e. with <, > and & escaped. + * We use HTML-safe strings, with several characters escaped. * * @see drupal_json_decode() + * @see drupal_json_encode_helper() * @ingroup php_wrappers */ function drupal_json_encode($var) { - // json_encode() does not escape <, > and &, so we do it with str_replace(). - return str_replace(array('<', '>', '&'), array('\u003c', '\u003e', '\u0026'), json_encode($var)); + // The PHP version cannot change within a request. + static $php530; + + if (!isset($php530)) { + $php530 = version_compare(PHP_VERSION, '5.3.0', '>='); + } + + if ($php530) { + // Encode <, >, ', &, and " using the json_encode() options parameter. + return json_encode($var, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_AMP | JSON_HEX_QUOT); + } + + // json_encode() escapes <, >, ', &, and " using its options parameter, but + // does not support this parameter prior to PHP 5.3.0. Use a helper instead. + include_once DRUPAL_ROOT . '/includes/json-encode.inc'; + return drupal_json_encode_helper($var); } /** diff --git a/includes/json-encode.inc b/includes/json-encode.inc new file mode 100644 index 000000000..1efd6ddbe --- /dev/null +++ b/includes/json-encode.inc @@ -0,0 +1,102 @@ +<?php + +/** + * @file + * Provides a helper to properly encode HTML-safe JSON prior to PHP 5.3.0. + */ + +/** + * Encodes a PHP variable to HTML-safe JSON for PHP versions below 5.3.0. + * + * @see drupal_json_encode() + */ +function drupal_json_encode_helper($var) { + switch (gettype($var)) { + case 'boolean': + return $var ? 'true' : 'false'; // Lowercase necessary! + + case 'integer': + case 'double': + return $var; + + case 'resource': + case 'string': + // Always use Unicode escape sequences (\u0022) over JSON escape + // sequences (\") to prevent browsers interpreting these as + // special characters. + $replace_pairs = array( + // ", \ and U+0000 - U+001F must be escaped according to RFC 4627. + '\\' => '\u005C', + '"' => '\u0022', + "\x00" => '\u0000', + "\x01" => '\u0001', + "\x02" => '\u0002', + "\x03" => '\u0003', + "\x04" => '\u0004', + "\x05" => '\u0005', + "\x06" => '\u0006', + "\x07" => '\u0007', + "\x08" => '\u0008', + "\x09" => '\u0009', + "\x0a" => '\u000A', + "\x0b" => '\u000B', + "\x0c" => '\u000C', + "\x0d" => '\u000D', + "\x0e" => '\u000E', + "\x0f" => '\u000F', + "\x10" => '\u0010', + "\x11" => '\u0011', + "\x12" => '\u0012', + "\x13" => '\u0013', + "\x14" => '\u0014', + "\x15" => '\u0015', + "\x16" => '\u0016', + "\x17" => '\u0017', + "\x18" => '\u0018', + "\x19" => '\u0019', + "\x1a" => '\u001A', + "\x1b" => '\u001B', + "\x1c" => '\u001C', + "\x1d" => '\u001D', + "\x1e" => '\u001E', + "\x1f" => '\u001F', + // Prevent browsers from interpreting these as as special. + "'" => '\u0027', + '<' => '\u003C', + '>' => '\u003E', + '&' => '\u0026', + // Prevent browsers from interpreting the solidus as special and + // non-compliant JSON parsers from interpreting // as a comment. + '/' => '\u002F', + // While these are allowed unescaped according to ECMA-262, section + // 15.12.2, they cause problems in some JSON parsers. + "\xe2\x80\xa8" => '\u2028', // U+2028, Line Separator. + "\xe2\x80\xa9" => '\u2029', // U+2029, Paragraph Separator. + ); + + return '"' . strtr($var, $replace_pairs) . '"'; + + case 'array': + // Arrays in JSON can't be associative. If the array is empty or if it + // has sequential whole number keys starting with 0, it's not associative + // so we can go ahead and convert it as an array. + if (empty($var) || array_keys($var) === range(0, sizeof($var) - 1)) { + $output = array(); + foreach ($var as $v) { + $output[] = drupal_json_encode_helper($v); + } + return '[ ' . implode(', ', $output) . ' ]'; + } + // Otherwise, fall through to convert the array as an object. + + case 'object': + $output = array(); + foreach ($var as $k => $v) { + $output[] = drupal_json_encode_helper(strval($k)) . ':' . drupal_json_encode_helper($v); + } + return '{' . implode(', ', $output) . '}'; + + default: + return 'null'; + } +} |