Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

encoding/json: addrMarshalerEncoder does not respect SetEscapeHTML #32896

Closed
nkovacs opened this issue Jul 2, 2019 · 3 comments
Closed

encoding/json: addrMarshalerEncoder does not respect SetEscapeHTML #32896

nkovacs opened this issue Jul 2, 2019 · 3 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone

Comments

@nkovacs
Copy link

nkovacs commented Jul 2, 2019

What version of Go are you using (go version)?

1.12.5 (playground)

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

play.golang.org

What did you do?

https://play.golang.org/p/lt-Mky4vAtq

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
)

type T1 int
type T2 int

func (t T1) MarshalJSON() ([]byte, error) {
	return []byte(`"<script>T1</script>"`), nil
}

func (t *T2) MarshalJSON() ([]byte, error) {
	return []byte(`"<script>T2</script>"`), nil
}

func main() {
	var t struct {
		T1 T1
		T2 T2
	}

	var out bytes.Buffer
	encoder := json.NewEncoder(&out)
	encoder.SetEscapeHTML(false)

	err := encoder.Encode(&t)
	if err != nil {
		panic(err)
	}

	fmt.Println(out.String())
}

What did you expect to see?

{"T1":"<script>T1</script>","T2":"<script>T2</script>"}

What did you see instead?

{"T1":"<script>T1</script>","T2":"\u003cscript\u003eT2\u003c/script\u003e"}

I noticed this inconsistency while studying the code of encoding/json, and I believe this is an edge case that was missed in #14749.

@bcmills
Copy link
Member

bcmills commented Jul 2, 2019

CC @cespare @dsnet @mvdan

@bcmills bcmills added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jul 2, 2019
@bcmills bcmills added this to the Go1.13 milestone Jul 2, 2019
@gopherbot
Copy link

Change https://golang.org/cl/184757 mentions this issue: encoding/json: obey SetEscapeHTML in all MarshalJSON cases

@mvdan
Copy link
Member

mvdan commented Jul 2, 2019

Thanks - this seems like a simple fix, so I've sent a CL with a test.

@golang golang locked and limited conversation to collaborators Jul 5, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Development

No branches or pull requests

4 participants