Merge pull request #534 from michaelhkay/Issue530-escape-solidus

530: escape solidus in JSON
qt4cg · Jun 6, 2023 · 6e2a566 · 6e2a566
2 parents 78278ec + 90c8fdb
commit 6e2a566
Show file tree

Hide file tree

Showing 7 changed files with 98 additions and 5 deletions.
diff --git a/specifications/xpath-functions-40/src/function-catalog.xml b/specifications/xpath-functions-40/src/function-catalog.xml
@@ -16076,6 +16076,18 @@ else
                      <code>utf-8</code>
                   </td>
                </tr>
+               <tr diff="add" at="2023-03-31">
+                  <td>
+                     <code>escape-solidus</code>
+                  </td>
+                  <td>
+                     <code>xs:boolean?</code>
+                  </td>
+                  <td><code>true()</code> means <code>"yes"</code>, <code>false()</code> means <code>"no"</code></td>
+                  <td>
+                     <code>yes</code>
+                  </td>
+               </tr>
                <tr>
                   <td>
                      <code>escape-uri-attributes</code>

diff --git a/specifications/xquery-40/src/back-matter.xml b/specifications/xquery-40/src/back-matter.xml
@@ -645,6 +645,13 @@ per lexical scope.</td>
   <td>overwriteable by prolog</td>
   <td>no</td>
   <td><xspecref spec="SER31" ref="serparam"/></td></tr>
+  <tr>
+    <td>escape-solidus</td>
+    <td>yes</td>
+    <td>overwriteable and augmentable</td>
+    <td>overwriteable by prolog</td>
+    <td>yes</td>
+    <td><xspecref spec="SER31" ref="serparam"/></td></tr>  
 <tr>
   <td>escape-uri-attributes</td>
   <td>yes</td>

diff --git a/specifications/xslt-40/src/element-catalog.xml b/specifications/xslt-40/src/element-catalog.xml
@@ -1869,6 +1869,11 @@
             <e:data-type name="string"/>
          </e:attribute-value-template>
       </e:attribute>
+      <e:attribute name="escape-solidus">
+         <e:attribute-value-template>
+            <e:data-type name="boolean"/>
+         </e:attribute-value-template>
+      </e:attribute>
       <e:attribute name="escape-uri-attributes">
          <e:attribute-value-template>
             <e:data-type name="boolean"/>
@@ -1996,6 +2001,9 @@
       <e:attribute name="encoding">
          <e:data-type name="string"/>
       </e:attribute>
+      <e:attribute name="escape-solidus">
+         <e:data-type name="boolean"/>
+      </e:attribute>
       <e:attribute name="escape-uri-attributes">
          <e:data-type name="boolean"/>
       </e:attribute>

diff --git a/specifications/xslt-40/src/schema-for-xslt40.xsd b/specifications/xslt-40/src/schema-for-xslt40.xsd
@@ -1371,6 +1371,7 @@ of problems processing the schema using various tools
           <xs:attribute name="doctype-public" type="xs:string"/>
           <xs:attribute name="doctype-system" type="xs:string"/>
           <xs:attribute name="encoding" type="xs:string"/>
+          <xs:attribute name="escape-solidus" type="xsl:yes-or-no"/>
           <xs:attribute name="escape-uri-attributes" type="xsl:yes-or-no"/>
           <xs:attribute name="html-version" type="xs:decimal"/>
           <xs:attribute name="include-content-type" type="xsl:yes-or-no"/>
@@ -1393,6 +1394,7 @@ of problems processing the schema using various tools
           <xs:attribute name="_doctype-public" type="xs:string"/>
           <xs:attribute name="_doctype-system" type="xs:string"/>
           <xs:attribute name="_encoding" type="xs:string"/>
+          <xs:attribute name="_escape-solidus" type="xs:string"/>
           <xs:attribute name="_escape-uri-attributes" type="xs:string"/>
           <xs:attribute name="_html-version" type="xs:string"/>
           <xs:attribute name="_include-content-type" type="xs:string"/>
@@ -1589,6 +1591,7 @@ of problems processing the schema using various tools
           <xs:attribute name="doctype-public" type="xsl:avt"/>
           <xs:attribute name="doctype-system" type="xsl:avt"/>
           <xs:attribute name="encoding" type="xsl:avt"/>
+          <xs:attribute name="escape-solidus" type="xsl:avt"/>
           <xs:attribute name="escape-uri-attributes" type="xsl:avt"/>
           <xs:attribute name="html-version" type="xsl:avt"/>
           <xs:attribute name="include-content-type" type="xsl:avt"/>
@@ -1614,6 +1617,7 @@ of problems processing the schema using various tools
           <xs:attribute name="_doctype-public" type="xs:string"/>
           <xs:attribute name="_doctype-system" type="xs:string"/>
           <xs:attribute name="_encoding" type="xs:string"/>
+          <xs:attribute name="_escape-solidus" type="xs:string"/>
           <xs:attribute name="_escape-uri-attributes" type="xs:string"/>
           <xs:attribute name="_html-version" type="xs:string"/>
           <xs:attribute name="_include-content-type" type="xs:string"/>

diff --git a/specifications/xslt-40/src/xslt.xml b/specifications/xslt-40/src/xslt.xml
@@ -36302,6 +36302,7 @@ return ($m?price - $m?discount)</eg>
             <p>The attributes <code>method</code>, <code>allow-duplicate-names</code>, <code>build-tree</code>, <code>byte-order-mark</code>
                <code>cdata-section-elements</code>, <code>doctype-public</code>,
                   <code>doctype-system</code>, <code>encoding</code>,
+               <code diff="add" at="2023-03-31">escape-solidus</code>
                   <code>escape-uri-attributes</code>, <code>html-version</code>, <code>indent</code>, <code>item-separator</code>,
                <code>json-node-output-method</code>,
                   <code>media-type</code>, <code>normalization-form</code>,
@@ -37511,6 +37512,11 @@ return ($m?price - $m?discount)</eg>
                <p>The value of <code>doctype-public</code> must conform to the rules for a <xnt spec="XML" ref="PubidLiteral">PubidLiteral</xnt> (see <bibref ref="REC-xml"/>).</p>
                <!--End of text inserted by erratum E3-->
             </item>
+            <item diff="add" at="2023-05-31">
+               <p> The value of the <code>escape-solidus</code> attribute provides the value
+                  of the <code>escape-solidus</code> parameter to the serialization method.
+                  The default value is <code>yes</code>. </p>
+            </item>
             <item>
                <p> The value of the <code>escape-uri-attributes</code> attribute provides the value
                   of the <code>escape-uri-attributes</code> parameter to the serialization method.
@@ -38908,6 +38914,8 @@ See <loc href="http://www.w3.org/TR/xhtml11/"/>
                   <xfunction>type-available</xfunction>, <xfunction>system-property</xfunction>,
                   <xfunction>accumulator-before</xfunction>, and <xfunction>accumulator-after</xfunction>,
                now have the option of supplying an <code>xs:QName</code> value instead.</p></item>
+               <item><p>A serialization parameter <code>escape-solidus</code> has been added, for use
+               in JSON serialization.</p></item>
             </olist>
             </div3>
             <div3 id="changes-in-draft-B">

diff --git a/specifications/xslt-xquery-serialization-40/src/schema-for-serialization-parameters.xsd b/specifications/xslt-xquery-serialization-40/src/schema-for-serialization-parameters.xsd
@@ -380,6 +380,17 @@
               type="output:encoding-param-type"
               substitutionGroup
               = "output:serialization-parameter-element"/>
+
+  <!--
+     - Serialization parameter element for escape-solidus
+       parameter
+    -->
+  <xs:element id="escape-solidus"
+    name="escape-solidus"
+    type="output:yes-no-param-type"
+    substitutionGroup
+    = "output:serialization-parameter-element"/>
+
 
   <!--
      - Serialization parameter element for escape-uri-attributes

diff --git a/specifications/xslt-xquery-serialization-40/src/xslt-xquery-serialization.xml b/specifications/xslt-xquery-serialization-40/src/xslt-xquery-serialization.xml
@@ -670,6 +670,12 @@ This parameter <rfc2119>MAY</rfc2119> be absent.</td>
           characters <code>x-</code> or <code>X-</code>.</td>
 </tr>
 
+  <tr diff="add" at="2023-03-31">
+    <td rowspan="1" colspan="1"><code>escape-solidus</code></td>
+    <td rowspan="1" colspan="1">One of the enumerated values 
+      <code>yes</code>, <code>no</code>, <code>true</code>, <code>false</code>, <code>1</code> or <code>0</code>.
+    </td></tr>
+
 <tr>
 <td rowspan="1" colspan="1"><code>escape-uri-attributes</code></td>
 <td rowspan="1" colspan="1">One of the enumerated values 
@@ -2002,7 +2008,11 @@ when the encoding is UTF-16,
 even though the XML 1.0 and XML 1.1 specifications state that entities encoded in UTF-16 <rfc2119>MUST</rfc2119> begin with a byte order mark.  
 Consequently, this specification does not guarantee that the resulting XML fragment, 
 without a byte order mark, will not cause an error when processed by a conforming XML processor.</p></note></div3>
-<div3 id="XML_ESCAPE-URI-ATTRIBUTES"><head>XML Output Method: the <code>escape-uri-attributes</code> Parameter</head><p>The <code>escape-uri-attributes</code> parameter is
+  <div3 id="XML_ESCAPE-SOLIDUS" diff="add" at="2023-05-31"><head>XML Output Method: the <code>escape-solidus</code> Parameter</head><p>The <code>escape-uri-attributes</code> parameter is
+    not applicable to the XML output method.  It
+    is the responsibility of the <termref def="host-language">host language</termref> to specify whether an error occurs if this parameter is specified in combination with the XML output method, or if the parameter is simply dropped.</p></div3>
+
+  <div3 id="XML_ESCAPE-URI-ATTRIBUTES"><head>XML Output Method: the <code>escape-uri-attributes</code> Parameter</head><p>The <code>escape-uri-attributes</code> parameter is
 not applicable to the XML output method.  It
 is the responsibility of the <termref def="host-language">host language</termref> to specify whether an error occurs if this parameter is specified in combination with the XML output method, or if the parameter is simply dropped.</p></div3>
 <div3 id="XML_INCLUDE-CONTENT-TYPE"><head>XML Output Method: the <code>include-content-type</code> Parameter</head><p>The <code>include-content-type</code> parameter is
@@ -2493,7 +2503,11 @@ name of the element.</p>
 <div3 id="XHTML_MEDIA-TYPE"><head>XHTML Output Method: the <code>media-type</code> Parameter</head><p>The behavior for <code>media-type</code> parameter for the XHTML output method is described in <specref ref="XML_MEDIA-TYPE"/>.</p></div3>
 <div3 id="XHTML_USE-CHARACTER-MAPS"><head>XHTML Output Method: the <code>use-character-maps</code> Parameter</head><p>The behavior for <code>use-character-maps</code> parameter for the XHTML output method is described in <specref ref="XML_USE-CHARACTER-MAPS"/>.</p></div3>
 <div3 id="XHTML_BYTE-ORDER-MARK"><head>XHTML Output Method: the <code>byte-order-mark</code> Parameter</head><p>The behavior for <code>byte-order-mark</code> parameter for the XHTML output method is described in <specref ref="XML_BYTE-ORDER-MARK"/>.</p></div3>
-<div3 id="XHTML_ESCAPE-URI-ATTRIBUTES"><head>XHTML Output Method: the <code>escape-uri-attributes</code> Parameter</head><p>
+  <div3 id="XHTML_ESCAPE-SOLIDUS" diff="add" at="2023-05-31"><head>XHTML Output Method: the <code>escape-solidus</code> Parameter</head><p>The <code>escape-uri-attributes</code> parameter is
+    not applicable to the XHTML output method.  It
+    is the responsibility of the <termref def="host-language">host language</termref> to specify whether an error occurs if this parameter is specified in combination with the XML output method, or if the parameter is simply dropped.</p></div3>
+
+  <div3 id="XHTML_ESCAPE-URI-ATTRIBUTES"><head>XHTML Output Method: the <code>escape-uri-attributes</code> Parameter</head><p>
 
 If the <code>escape-uri-attributes</code> parameter has
 one of the values <code>yes</code>, <code>true</code> or <code>1</code>,
@@ -3133,6 +3147,10 @@ information.</p></div3>
 <div3 id="HTML_BYTE-ORDER-MARK"><head>HTML Output Method: the <code>byte-order-mark</code> Parameter</head><p>The <code>byte-order-mark</code> parameter is
 applicable to the HTML output method.  See
 <specref ref="serparam"/> for more information.</p></div3>
+  <div3 id="HTML_ESCAPE-SOLIDUS" diff="add" at="2023-05-31"><head>HTML Output Method: the <code>escape-solidus</code> Parameter</head><p>The <code>escape-uri-attributes</code> parameter is
+    not applicable to the HTML output method.  It
+    is the responsibility of the <termref def="host-language">host language</termref> to specify whether an error occurs if this parameter is specified in combination with the XML output method, or if the parameter is simply dropped.</p></div3>
+
 <div3 id="HTML_ESCAPE-URI-ATTRIBUTES"><head>HTML Output Method: the <code>escape-uri-attributes</code> Parameter</head><p>
 If the <code>escape-uri-attributes</code> parameter
 has one of the values <code>yes</code>, <code>true</code> or <code>1</code>,
@@ -3346,6 +3364,10 @@ information.</p></div3>
 <div3 id="TEXT_BYTE-ORDER-MARK"><head>Text Output Method: the <code>byte-order-mark</code> Parameter</head><p>The <code>byte-order-mark</code> parameter is
 applicable to the Text output method.  See
 <specref ref="serparam"/> for more information.</p></div3>
+  <div3 id="TEXT_ESCAPE-SOLIDUS" diff="add" at="2023-05-31"><head>Text Output Method: the <code>escape-solidus</code> Parameter</head><p>The <code>escape-uri-attributes</code> parameter is
+    not applicable to the Text output method.  It
+    is the responsibility of the <termref def="host-language">host language</termref> to specify whether an error occurs if this parameter is specified in combination with the XML output method, or if the parameter is simply dropped.</p></div3>
+
 <div3 id="TEXT_ESCAPE-URI-ATTRIBUTES"><head>Text Output Method: the <code>escape-uri-attributes</code> Parameter</head><p>The <code>escape-uri-attributes</code> parameter is not applicable to the Text output method.</p></div3>
 <div3 id="TEXT_INCLUDE-CONTENT-TYPE"><head>Text Output Method: the <code>include-content-type</code> Parameter</head><p>The <code>include-content-type</code> parameter is not applicable to the Text output method.</p>
 </div3>
@@ -3477,13 +3499,17 @@ is a candidate for
 <termref def="unicode-normalization">Unicode Normalization</termref> if requested by the <code>normalization-form</code> parameter,
 and JSON escaping. JSON escaping replaces the characters 
 quotation mark, backspace, form-feed, newline, carriage return, 
- tab, reverse solidus, or 
-solidus by the corresponding JSON escape sequences
+ tab, or reverse solidus<phrase diff="del" at="2023-05-31">, or 
+solidus</phrase> by the corresponding JSON escape sequences
 <code>\"</code>, <code>\b</code>, <code>\f</code>, <code>\n</code>,
-<code>\r</code>, <code>\t</code>, <code>\\</code>, or <code>\/</code> 
+  <code>\r</code>, <code>\t</code>, or <code>\\</code><phrase diff="del" at="2023-05-31">, or <code>\/</code></phrase> 
 respectively, and any other codepoint in the 
 range 1-31 or 127-159 by an escape in the form <code>\uHHHH</code> 
 where <code>HHHH</code> is the hexadecimal representation of the codepoint value.
+  <phrase diff="add" at="2023-05-31">Escaping further replaces the solidus character (<code>/</code>)
+  by the escape sequence <code>\/</code> if the <code>escape-solidus</code> parameter
+  is set to <code>true</code>, <code>yes</code>, or <code>1</code>, but not if it is
+  set to <code>false</code>, <code>no</code>, or <code>0</code>.</phrase>
 Escaping is also applied to any characters that cannot be represented in the selected encoding.
 </p></item>
 <item><p>The resulting string is enclosed in double quotation marks.</p></item>
@@ -3611,6 +3637,19 @@ conform to the definition of JSON in <bibref ref="rfc7159"/>
 the byte-order mark).</p>
 </note>
 </div3>
+
+  <div3 id="JSON_ESCAPE-SOLIDUS" diff="add" at="2023-05-31"><head>JSON Output Method: the <code>escape-solidus</code> Parameter</head>
+    <p>The <code>escape-uri-attributes</code> parameter is
+      applicable to the JSON output method. If the value is <code>yes</code>, <code>true</code>, or <code>1</code>,
+      then the solidus character (<code>"/"</code>) appearing in a string is escaped with a backslash
+      (as <code>"\/"</code>). If the value is <code>no</code>, <code>false</code>, or <code>0</code>,
+    then it is not escaped.</p>
+
+  <note><p>In previous versions of this specification, the solidus was always escaped. Although JSON does not require
+  this character to be escaped, doing so provides extra safety when the generated JSON is embedded in an HTML <code>script</code>
+  element, since an unintended <code>&lt;/script></code> end tag might otherwise cause the script to be prematurely
+  terminated. In other situations, however, the escaping creates visual clutter and makes the output less readable.</p></note></div3>
+
 
 <div3 id="JSON_ESCAPE-URI-ATTRIBUTES"><head>JSON Output Method: the <code>escape-uri-attributes</code> Parameter</head><p>The <code>escape-uri-attributes</code> parameter is not applicable to the JSON output method.</p></div3>
 
@@ -3979,6 +4018,10 @@ Adaptive output method. See
 <note><p>A byte order mark can appear only once in the serialized output.
 Therefore, this parameter does not get passed down to any delegated output method.</p></note>
 </div3>
+
+  <div3 id="ADAPTIVE_ESCAPE-SOLIDUS" diff="add" at="2023-05-31"><head>Adaptive Output Method: the <code>escape-solidus</code> Parameter</head><p>The <code>escape-uri-attributes</code> parameter is
+    applicable to the Adaptive output method only as elsewhere specified.</p></div3>
+
 
 <div3 id="ADAPTIVE_ESCAPE-URI-ATTRIBUTES">
 <head>Adaptive Output Method: the <code>escape-uri-attributes</code> Parameter</head>