Skip to content

escape: remove too agressive JSON escaping #248

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RyanGlScott merged 1 commit into from
Dec 8, 2021
+29 −7
Merged

escape: remove too agressive JSON escaping #248

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions Criterion/Report.hs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,8 +119,14 @@ report reports = do
-- (should only affect old versions of IE).
--
-- The following characters are replaced with their unicode escape sequnces
-- (\uXXXX) <, >, &, +, \0, \n, \r, ' (single quote), /, \, \x2028 (line
-- separator) and \x2029 (paragraph separator)
-- (\uXXXX):
-- <, >, &, +, \x2028 (line separator), and \x2029 (paragraph
-- separator)
--
-- Other characters are such as \\ (backslash) and \n (newline) are not escaped
-- here as the JSON serializer @encodeToLazyText@ already escapes them when
-- they occur inside JSON strings and they cause no issues with respect to HTML
-- safety when used outside of strings in the JSON-encoded payload.
escapeJSON :: Char -> TL.Text
escapeJSON '<' = "\\u003c" -- ban closing of the script tag by making </ impossible
escapeJSON '>' = "\\u003e" -- encode tags with unicode escape sequences
Expand All @@ -129,11 +135,6 @@ escapeJSON '\x2029' = "\\u2029" -- paragraph separator
escapeJSON '&' = "\\u0026" -- avoid HTML entities
escapeJSON '+' = "\\u002b" -- + can be used in UTF-7 escape sequences
escapeJSON '\0' = "\\u0000" -- make null characters explicit
escapeJSON '\n' = "\\u000a" -- for good measure also escape newlines
Comment thread
RyanGlScott marked this conversation as resolved.
escapeJSON '\r' = "\\u000d" -- , carriage returns
escapeJSON '\'' = "\\u0027" -- , single quotes
escapeJSON '/' = "\\u002f" -- , slashes
escapeJSON '\\' = "\\u005c" -- , and backslashes
escapeJSON c = TL.singleton c

-- | Format a series of 'Report' values using the given Mustache template.
Expand Down
12 changes: 12 additions & 0 deletions examples/Quotes.hs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
module Main where

import Criterion
import Criterion.Main

main :: IO ()
main = defaultMain
[ env (return ()) $
\ ~() -> bgroup "\"oops\"" [bench "dummy" $ nf id ()]
Comment thread
RyanGlScott marked this conversation as resolved.
, env (return ()) $
\ ~() -> bgroup "'oops'" [bench "dummy" $ nf id ()]
]
9 changes: 9 additions & 0 deletions examples/criterion-examples.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,15 @@ executable extensible-cli
criterion,
optparse-applicative

executable quotes
main-is: Quotes.hs

default-language: Haskell2010
ghc-options: -Wall -rtsopts
build-depends:
base == 4.*,
criterion

-- Cannot uncomment due to https://github.com/haskell/cabal/issues/1725
--
-- executable judy
Expand Down