After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 727593 - JsonGenerator fails to escape object key strings
JsonGenerator fails to escape object key strings
Status: RESOLVED FIXED
Product: json-glib
Classification: Core
Component: Generator
git master
Other Linux
: Normal normal
: ---
Assigned To: json-glib-maint
json-glib-maint
Depends on:
Blocks:
 
 
Reported: 2014-04-04 09:39 UTC by Stef Walter
Modified: 2014-05-21 09:54 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
generator: Escape Object key names correctly (3.30 KB, patch)
2014-05-20 08:45 UTC, Stef Walter 		committed Details | Review

Description Stef Walter 2014-04-04 09:39:05 UTC 
JsonGenerator fails to escape object member name strings. Not only is this flakey, it can lead to SQL injection style vulnerabilities.

For example:

  if (name && name[0] != '\0')
    {
      if (pretty)
        g_string_append_printf (buffer, "\"%s\" : ", name);
      else
        g_string_append_printf (buffer, "\"%s\":", name);
    }

In addition json-glib does not support empty key names for objects. It generates invalid JSON when an object member name is an empty string.
Comment 1 Stef Walter 2014-05-20 08:45:18 UTC 
Created attachment 276826 [details] [review]
generator: Escape Object key names correctly

Also fix empty keys, which are now encoded properly.
Comment 2 Emmanuele Bassi (:ebassi) 2014-05-20 10:43:20 UTC 
Review of attachment 276826 [details] [review]:

looks good.
Comment 3 Stef Walter 2014-05-21 09:53:58 UTC 
Attachment 276826 [details] pushed as 8f4816a - generator: Escape Object key names correctly