diff options
| -rw-r--r-- | includes/common.inc | 21 | ||||
| -rw-r--r-- | includes/json-encode.inc | 102 | ||||
| -rw-r--r-- | modules/simpletest/tests/common.test | 11 | ||||
| -rw-r--r-- | modules/taxonomy/taxonomy.test | 6 |
4 files changed, 132 insertions, 8 deletions
diff --git a/includes/common.inc b/includes/common.inc index f95597f87..6cdd22bde 100644 --- a/includes/common.inc +++ b/includes/common.inc @@ -4804,14 +4804,29 @@ function drupal_clear_js_cache() { /** * Converts a PHP variable into its JavaScript equivalent. * - * We use HTML-safe strings, i.e. with <, > and & escaped. + * We use HTML-safe strings, with several characters escaped. * * @see drupal_json_decode() + * @see drupal_json_encode_helper() * @ingroup php_wrappers */ function drupal_json_encode($var) { - // json_encode() does not escape <, > and &, so we do it with str_replace(). - return str_replace(array('<', '>', '&'), array('\u003c', '\u003e', '\u0026'), json_encode($var)); + // The PHP version cannot change within a request. + static $php530; + + if (!isset($php530)) { + $php530 = version_compare(PHP_VERSION, '5.3.0', '>='); + } + + if ($php530) { + // Encode <, >, ', &, and " using the json_encode() options parameter. + return json_encode($var, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_AMP | JSON_HEX_QUOT); + } + + // json_encode() escapes <, >, ', &, and " using its options parameter, but + // does not support this parameter prior to PHP 5.3.0. Use a helper instead. + include_once DRUPAL_ROOT . '/includes/json-encode.inc'; + return drupal_json_encode_helper($var); } /** diff --git a/includes/json-encode.inc b/includes/json-encode.inc new file mode 100644 index 000000000..1efd6ddbe --- /dev/null +++ b/includes/json-encode.inc @@ -0,0 +1,102 @@ +<?php + +/** + * @file + * Provides a helper to properly encode HTML-safe JSON prior to PHP 5.3.0. + */ + +/** + * Encodes a PHP variable to HTML-safe JSON for PHP versions below 5.3.0. + * + * @see drupal_json_encode() + */ +function drupal_json_encode_helper($var) { + switch (gettype($var)) { + case 'boolean': + return $var ? 'true' : 'false'; // Lowercase necessary! + + case 'integer': + case 'double': + return $var; + + case 'resource': + case 'string': + // Always use Unicode escape sequences (\u0022) over JSON escape + // sequences (\") to prevent browsers interpreting these as + // special characters. + $replace_pairs = array( + // ", \ and U+0000 - U+001F must be escaped according to RFC 4627. + '\\' => '\u005C', + '"' => '\u0022', + "\x00" => '\u0000', + "\x01" => '\u0001', + "\x02" => '\u0002', + "\x03" => '\u0003', + "\x04" => '\u0004', + "\x05" => '\u0005', + "\x06" => '\u0006', + "\x07" => '\u0007', + "\x08" => '\u0008', + "\x09" => '\u0009', + "\x0a" => '\u000A', + "\x0b" => '\u000B', + "\x0c" => '\u000C', + "\x0d" => '\u000D', + "\x0e" => '\u000E', + "\x0f" => '\u000F', + "\x10" => '\u0010', + "\x11" => '\u0011', + "\x12" => '\u0012', + "\x13" => '\u0013', + "\x14" => '\u0014', + "\x15" => '\u0015', + "\x16" => '\u0016', + "\x17" => '\u0017', + "\x18" => '\u0018', + "\x19" => '\u0019', + "\x1a" => '\u001A', + "\x1b" => '\u001B', + "\x1c" => '\u001C', + "\x1d" => '\u001D', + "\x1e" => '\u001E', + "\x1f" => '\u001F', + // Prevent browsers from interpreting these as as special. + "'" => '\u0027', + '<' => '\u003C', + '>' => '\u003E', + '&' => '\u0026', + // Prevent browsers from interpreting the solidus as special and + // non-compliant JSON parsers from interpreting // as a comment. + '/' => '\u002F', + // While these are allowed unescaped according to ECMA-262, section + // 15.12.2, they cause problems in some JSON parsers. + "\xe2\x80\xa8" => '\u2028', // U+2028, Line Separator. + "\xe2\x80\xa9" => '\u2029', // U+2029, Paragraph Separator. + ); + + return '"' . strtr($var, $replace_pairs) . '"'; + + case 'array': + // Arrays in JSON can't be associative. If the array is empty or if it + // has sequential whole number keys starting with 0, it's not associative + // so we can go ahead and convert it as an array. + if (empty($var) || array_keys($var) === range(0, sizeof($var) - 1)) { + $output = array(); + foreach ($var as $v) { + $output[] = drupal_json_encode_helper($v); + } + return '[ ' . implode(', ', $output) . ' ]'; + } + // Otherwise, fall through to convert the array as an object. + + case 'object': + $output = array(); + foreach ($var as $k => $v) { + $output[] = drupal_json_encode_helper(strval($k)) . ':' . drupal_json_encode_helper($v); + } + return '{' . implode(', ', $output) . '}'; + + default: + return 'null'; + } +} diff --git a/modules/simpletest/tests/common.test b/modules/simpletest/tests/common.test index a643ff94f..987efbf3a 100644 --- a/modules/simpletest/tests/common.test +++ b/modules/simpletest/tests/common.test @@ -2341,8 +2341,10 @@ class DrupalJSONTest extends DrupalUnitTestCase { $str .= chr($i); } // Characters that must be escaped. - $html_unsafe = array('<', '>', '&'); - $html_unsafe_escaped = array('\u003c', '\u003e', '\u0026'); + // We check for unescaped " separately. + $html_unsafe = array('<', '>', '\'', '&'); + // The following are the encoded forms of: < > ' & " + $html_unsafe_escaped = array('\u003C', '\u003E', '\u0027', '\u0026', '\u0022'); // Verify there aren't character encoding problems with the source string. $this->assertIdentical(strlen($str), 128, t('A string with the full ASCII table has the correct length.')); @@ -2354,6 +2356,11 @@ class DrupalJSONTest extends DrupalUnitTestCase { $json = drupal_json_encode($str); $this->assertTrue(strlen($json) > strlen($str), t('A JSON encoded string is larger than the source string.')); + // The first and last characters should be ", and no others. + $this->assertTrue($json[0] == '"', t('A JSON encoded string begins with ".')); + $this->assertTrue($json[strlen($json) - 1] == '"', t('A JSON encoded string ends with ".')); + $this->assertTrue(substr_count($json, '"') == 2, t('A JSON encoded string contains exactly two ".')); + // Verify that encoding/decoding is reversible. $json_decoded = drupal_json_decode($json); $this->assertIdentical($str, $json_decoded, t('Encoding a string to JSON and decoding back results in the original string.')); diff --git a/modules/taxonomy/taxonomy.test b/modules/taxonomy/taxonomy.test index 9a89b9c98..d8a86d760 100644 --- a/modules/taxonomy/taxonomy.test +++ b/modules/taxonomy/taxonomy.test @@ -627,11 +627,11 @@ class TaxonomyTermTestCase extends TaxonomyWebTestCase { } $this->assertNoText($term1->name, t('The deleted term %name does not appear on the node page.', array('%name' => $term1->name))); - // Test autocomplete on term 2 - it contains a comma, so expect the key to - // be quoted. + // Test autocomplete on term 2, which contains a comma. + // The term will be quoted, and the " will be encoded in unicode (\u0022). $input = substr($term2->name, 0, 3); $this->drupalGet('taxonomy/autocomplete/taxonomy_' . $this->vocabulary->machine_name . '/' . $input); - $this->assertRaw('{"\"' . $term2->name . '\"":"' . $term2->name . '"}', t('Autocomplete returns term %term_name after typing the first 3 letters.', array('%term_name' => $term2->name))); + $this->assertRaw('{"\u0022' . $term2->name . '\u0022":"' . $term2->name . '"}', t('Autocomplete returns term %term_name after typing the first 3 letters.', array('%term_name' => $term2->name))); // Test autocomplete on term 3 - it is alphanumeric only, so no extra // quoting. |