commit e20dd5be4a86760a21aad62d8a7b3adc3d976a45 Author: Karsten Loesing <karsten.loesing@gmx.net> Date: Fri Jul 6 11:27:46 2012 +0200 Don't escape ' in JSON strings. Fixes #6309, found by lunar. --- src/org/torproject/onionoo/DetailDataWriter.java | 26 +++++++++++---------- 1 files changed, 14 insertions(+), 12 deletions(-) diff --git a/src/org/torproject/onionoo/DetailDataWriter.java b/src/org/torproject/onionoo/DetailDataWriter.java index 8602093..155c4eb 100644 --- a/src/org/torproject/onionoo/DetailDataWriter.java +++ b/src/org/torproject/onionoo/DetailDataWriter.java @@ -314,6 +314,10 @@ public class DetailDataWriter { return result; } + private static String escapeJSON(String s) { + return StringEscapeUtils.escapeJavaScript(s).replaceAll("\\\\'", "'"); + } + private SortedMap<String, File> updateRelayDetailsFiles( SortedMap<String, File> remainingDetailsFiles) { SortedMap<String, File> result = @@ -395,13 +399,11 @@ public class DetailDataWriter { sb.append("\n]"); if (descriptor.getContact() != null) { sb.append(",\n\"contact\":\"" - + StringEscapeUtils.escapeJavaScript( - descriptor.getContact()) + "\""); + + escapeJSON(descriptor.getContact()) + "\""); } if (descriptor.getPlatform() != null) { sb.append(",\n\"platform\":\"" - + StringEscapeUtils.escapeJavaScript( - descriptor.getPlatform()) + "\""); + + escapeJSON(descriptor.getPlatform()) + "\""); } if (descriptor.getFamilyEntries() != null) { sb.append(",\n\"family\":["); @@ -473,23 +475,23 @@ public class DetailDataWriter { } if (countryName != null) { sb.append(",\n\"country_name\":\"" - + StringEscapeUtils.escapeJavaScript(countryName) + "\""); + + escapeJSON(countryName) + "\""); } if (regionName != null) { sb.append(",\n\"region_name\":\"" - + StringEscapeUtils.escapeJavaScript(regionName) + "\""); + + escapeJSON(regionName) + "\""); } if (cityName != null) { sb.append(",\n\"city_name\":\"" - + StringEscapeUtils.escapeJavaScript(cityName) + "\""); + + escapeJSON(cityName) + "\""); } if (aSNumber != null) { sb.append(",\n\"as_number\":\"" - + StringEscapeUtils.escapeJavaScript(aSNumber) + "\""); + + escapeJSON(aSNumber) + "\""); } if (aSName != null) { sb.append(",\n\"as_name\":\"" - + StringEscapeUtils.escapeJavaScript(aSName) + "\""); + + escapeJSON(aSName) + "\""); } if (consensusWeight >= 0L) { sb.append(",\n\"consensus_weight\":" @@ -497,7 +499,7 @@ public class DetailDataWriter { } if (hostName != null) { sb.append(",\n\"host_name\":\"" - + StringEscapeUtils.escapeJavaScript(hostName) + "\""); + + escapeJSON(hostName) + "\""); } /* Add exit addresses if at least one of them is distinct from the @@ -625,8 +627,8 @@ public class DetailDataWriter { sb.append("\"desc_published\":\"" + publishedDateTime + "\",\n" + "\"last_restarted\":\"" + lastRestartedString + "\",\n" + "\"advertised_bandwidth\":" + advertisedBandwidth + ",\n" - + "\"platform\":\"" + StringEscapeUtils.escapeJavaScript( - descriptor.getPlatform()) + "\""); + + "\"platform\":\"" + escapeJSON(descriptor.getPlatform()) + + "\""); descriptorParts = sb.toString(); }