/ Check-in [475d8f82]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Change the JSON extension so that it disallows control characters inside of strings. Fix for ticket [6c9b5514077fed34551f98e64c09a10dc2fc8e16].
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: 475d8f82ec61a4ff3e6a7650731230ccecb6cc580d1397d189d0ba479d9bad4d
User & Date: drh 2017-04-10 12:25:05
Context
2017-04-10
12:31
Add a new JSON test case to verify that all control characters are escaped in the json_quote() function. check-in: 6ee12221 user: drh tags: trunk
12:25
Change the JSON extension so that it disallows control characters inside of strings. Fix for ticket [6c9b5514077fed34551f98e64c09a10dc2fc8e16]. check-in: 475d8f82 user: drh tags: trunk
2017-04-09
19:23
Do not expose the name of the internal Mem object in the public interface defined by sqlite3.h. check-in: 19dd753f user: drh tags: trunk
Changes
Hide Diffs Side-by-Side Diffs Ignore Whitespace Patch

Changes to ext/misc/json1.c.

   781    781       return j+1;
   782    782     }else if( c=='"' ){
   783    783       /* Parse string */
   784    784       u8 jnFlags = 0;
   785    785       j = i+1;
   786    786       for(;;){
   787    787         c = z[j];
   788         -      if( c==0 ) return -1;
          788  +      if( c<=0x1f ) return -1;  /* Control characters not allowed in strings */
   789    789         if( c=='\\' ){
   790    790           c = z[++j];
   791    791           if( c=='"' || c=='\\' || c=='/' || c=='b' || c=='f'
   792    792              || c=='n' || c=='r' || c=='t'
   793    793              || (c=='u' && jsonIs4Hex(z+j+1)) ){
   794    794             jnFlags = JNODE_ESCAPE;
   795    795           }else{

Changes to test/json102.test.

   314    314   do_execsql_test json102-1406 { SELECT json_valid('{"x":-0.1}') } 1
   315    315   do_execsql_test json102-1407 { SELECT json_valid('{"x":0.0000}') } 1
   316    316   do_execsql_test json102-1408 { SELECT json_valid('{"x":-0.0000}') } 1
   317    317   do_execsql_test json102-1409 { SELECT json_valid('{"x":01.5}') } 0
   318    318   do_execsql_test json102-1410 { SELECT json_valid('{"x":-01.5}') } 0
   319    319   do_execsql_test json102-1411 { SELECT json_valid('{"x":00}') } 0
   320    320   do_execsql_test json102-1412 { SELECT json_valid('{"x":-00}') } 0
          321  +
          322  +#------------------------------------------------------------------------
          323  +# 2017-04-10 ticket 6c9b5514077fed34551f98e64c09a10dc2fc8e16
          324  +# JSON extension accepts strings containing control characters.
          325  +#
          326  +# The JSON spec requires that all control characters be escaped.
          327  +#
          328  +do_execsql_test json102-1500 {
          329  +  WITH RECURSIVE c(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM c WHERE x<0x20)
          330  +  SELECT x FROM c WHERE json_valid(printf('{"a":"x%sz"}', char(x))) ORDER BY x;
          331  +} {32}
   321    332   
   322    333   finish_test