You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2021/05/28 11:49:46 UTC
[cxf] 01/02: CXF-8435 - JsonMapObjectReaderWriter doesn't escape
double quotes
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.4.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 9d423d4ceb41a6a025b1cada185f0255e731d3af
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri May 28 11:54:50 2021 +0100
CXF-8435 - JsonMapObjectReaderWriter doesn't escape double quotes
(cherry picked from commit fa01cfac792fb7cb2e6d553d38a7441a20c97ba8)
---
.../jaxrs/json/basic/JsonMapObjectReaderWriter.java | 14 ++++++++++++--
.../json/basic/JsonMapObjectReaderWriterTest.java | 13 +++++++++++++
.../security/jose/jws/JwsCompactReaderWriterTest.java | 18 ++++++++++++++++++
3 files changed, 43 insertions(+), 2 deletions(-)
diff --git a/rt/rs/extensions/json-basic/src/main/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriter.java b/rt/rs/extensions/json-basic/src/main/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriter.java
index 6c319ab..9b2fee7 100644
--- a/rt/rs/extensions/json-basic/src/main/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriter.java
+++ b/rt/rs/extensions/json-basic/src/main/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriter.java
@@ -82,7 +82,7 @@ public class JsonMapObjectReaderWriter {
out.append(OBJECT_START);
for (Iterator<Map.Entry<String, Object>> it = map.entrySet().iterator(); it.hasNext();) {
Map.Entry<String, Object> entry = it.next();
- out.append(DQUOTE).append(entry.getKey()).append(DQUOTE);
+ out.append(DQUOTE).append(escapeJson(entry.getKey())).append(DQUOTE);
out.append(COLON);
toJsonInternal(out, entry.getValue(), it.hasNext());
}
@@ -120,7 +120,12 @@ public class JsonMapObjectReaderWriter {
if (quotesNeeded) {
out.append(DQUOTE);
}
- out.append(value.toString());
+ String valueStr = value.toString();
+ if (value instanceof String) {
+ // If the value is a String, make sure to escape quotes
+ valueStr = escapeJson(valueStr);
+ }
+ out.append(valueStr);
if (quotesNeeded) {
out.append(DQUOTE);
}
@@ -361,4 +366,9 @@ public class JsonMapObjectReaderWriter {
}
+ private String escapeJson(String value) {
+ return value.replace("\"", "\\\"")
+ .replace("\\", "\\\\");
+ }
+
}
diff --git a/rt/rs/extensions/json-basic/src/test/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriterTest.java b/rt/rs/extensions/json-basic/src/test/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriterTest.java
index dcd0994..d08de1b 100644
--- a/rt/rs/extensions/json-basic/src/test/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriterTest.java
+++ b/rt/rs/extensions/json-basic/src/test/java/org/apache/cxf/jaxrs/json/basic/JsonMapObjectReaderWriterTest.java
@@ -22,6 +22,7 @@ package org.apache.cxf.jaxrs.json.basic;
import java.io.UncheckedIOException;
import java.util.Collections;
import java.util.Date;
+import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;
@@ -148,4 +149,16 @@ public class JsonMapObjectReaderWriterTest {
jsonMapObjectReaderWriter.fromJson(s);
}
+ @Test
+ public void testEscapeDoubleQuotes() throws Exception {
+ JsonMapObjectReaderWriter jsonMapObjectReaderWriter = new JsonMapObjectReaderWriter();
+ Map<String, Object> content = new HashMap<>();
+ content.put("userInput", "a\",\"exp\":9999999999,\"b\":\"x");
+ String json = jsonMapObjectReaderWriter.toJson(content);
+
+ Map<String, Object> map = jsonMapObjectReaderWriter.fromJson(json);
+ assertEquals(1, map.size());
+ assertEquals("userInput", map.keySet().iterator().next());
+ }
+
}
\ No newline at end of file
diff --git a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jws/JwsCompactReaderWriterTest.java b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jws/JwsCompactReaderWriterTest.java
index 2dca7a3..90f45b0 100644
--- a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jws/JwsCompactReaderWriterTest.java
+++ b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jws/JwsCompactReaderWriterTest.java
@@ -23,11 +23,13 @@ import java.security.Security;
import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.ECPublicKey;
import java.security.interfaces.RSAPublicKey;
+import java.time.Clock;
import java.util.Arrays;
import java.util.Collections;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
+import java.util.concurrent.TimeUnit;
import org.apache.cxf.jaxrs.json.basic.JsonMapObjectReaderWriter;
import org.apache.cxf.rs.security.jose.common.JoseConstants;
@@ -137,6 +139,22 @@ public class JwsCompactReaderWriterTest {
JwtClaims claims2 = consumer.getJwtClaims();
assertEquals(claims, claims2);
}
+
+ @Test
+ public void testEscapeDoubleQuotes() throws Exception {
+ final long exp = Clock.systemUTC().instant().getEpochSecond() + TimeUnit.MINUTES.toSeconds(5);
+
+ JwtClaims claims = new JwtClaims();
+ claims.setExpiryTime(exp);
+ claims.setClaim("userInput", "a\",\"exp\":9999999999,\"b\":\"x");
+
+ JwsCompactProducer jwsProducer = new JwsJwtCompactProducer(claims);
+ String jwsSequence = jwsProducer.signWith(new NoneJwsSignatureProvider());
+
+ JwsJwtCompactConsumer jwsConsumer = new JwsJwtCompactConsumer(jwsSequence);
+ assertEquals(exp, jwsConsumer.getJwtClaims().getExpiryTime().longValue());
+ }
+
@Test
public void testWriteReadJwsUnsigned() throws Exception {
JwsHeaders headers = new JwsHeaders(JoseType.JWT);