Issue #479368 by Heine, Roger Saner, xjm, mcarbone, keichee, asimmonds: Fixed Create RFC compliant HTML safe JSON.

2 files changed, 12 insertions, 5 deletions

diff --git a/modules/simpletest/tests/common.test b/modules/simpletest/tests/common.test
index a643ff94f..987efbf3a 100644
--- a/modules/simpletest/tests/common.test
+++ b/modules/simpletest/tests/common.test
@@ -2341,8 +2341,10 @@ class DrupalJSONTest extends DrupalUnitTestCase {
       $str .= chr($i);
     }
     // Characters that must be escaped.
-    $html_unsafe = array('<', '>', '&');
-    $html_unsafe_escaped = array('\u003c', '\u003e', '\u0026');
+    // We check for unescaped " separately.
+    $html_unsafe = array('<', '>', '\'', '&');
+    // The following are the encoded forms of: < > ' & "
+    $html_unsafe_escaped = array('\u003C', '\u003E', '\u0027', '\u0026', '\u0022');
 
     // Verify there aren't character encoding problems with the source string.
     $this->assertIdentical(strlen($str), 128, t('A string with the full ASCII table has the correct length.'));
@@ -2354,6 +2356,11 @@ class DrupalJSONTest extends DrupalUnitTestCase {
     $json = drupal_json_encode($str);
     $this->assertTrue(strlen($json) > strlen($str), t('A JSON encoded string is larger than the source string.'));
 
+    // The first and last characters should be ", and no others.
+    $this->assertTrue($json[0] == '"', t('A JSON encoded string begins with ".'));
+    $this->assertTrue($json[strlen($json) - 1] == '"', t('A JSON encoded string ends with ".'));
+    $this->assertTrue(substr_count($json, '"') == 2, t('A JSON encoded string contains exactly two ".'));
+
     // Verify that encoding/decoding is reversible.
     $json_decoded = drupal_json_decode($json);
     $this->assertIdentical($str, $json_decoded, t('Encoding a string to JSON and decoding back results in the original string.'));
diff --git a/modules/taxonomy/taxonomy.test b/modules/taxonomy/taxonomy.test
index 9a89b9c98..d8a86d760 100644
--- a/modules/taxonomy/taxonomy.test
+++ b/modules/taxonomy/taxonomy.test
@@ -627,11 +627,11 @@ class TaxonomyTermTestCase extends TaxonomyWebTestCase {
     }
     $this->assertNoText($term1->name, t('The deleted term %name does not appear on the node page.', array('%name' => $term1->name)));
 
-    // Test autocomplete on term 2 - it contains a comma, so expect the key to
-    // be quoted.
+    // Test autocomplete on term 2, which contains a comma.
+    // The term will be quoted, and the " will be encoded in unicode (\u0022).
     $input = substr($term2->name, 0, 3);
     $this->drupalGet('taxonomy/autocomplete/taxonomy_' . $this->vocabulary->machine_name . '/' . $input);
-    $this->assertRaw('{"\"' . $term2->name . '\"":"' . $term2->name . '"}', t('Autocomplete returns term %term_name after typing the first 3 letters.', array('%term_name' => $term2->name)));
+    $this->assertRaw('{"\u0022' . $term2->name . '\u0022":"' . $term2->name . '"}', t('Autocomplete returns term %term_name after typing the first 3 letters.', array('%term_name' => $term2->name)));
 
     // Test autocomplete on term 3 - it is alphanumeric only, so no extra
     // quoting.