--- parser3/src/classes/json.C 2014/05/04 01:38:01 1.30 +++ parser3/src/classes/json.C 2016/05/24 17:48:37 1.42 @@ -1,7 +1,7 @@ /** @file Parser: @b json parser class. - Copyright (c) 2000-2012 Art. Lebedev Studio (http://www.artlebedev.com) + Copyright (c) 2000-2015 Art. Lebedev Studio (http://www.artlebedev.com) */ #include "classes.h" @@ -18,7 +18,7 @@ #include "pa_vxdoc.h" #endif -volatile const char * IDENT_JSON_C="$Id: json.C,v 1.30 2014/05/04 01:38:01 misha Exp $"; +volatile const char * IDENT_JSON_C="$Id: json.C,v 1.42 2016/05/24 17:48:37 moko Exp $"; // class @@ -29,7 +29,7 @@ public: // global variable -DECLARE_CLASS_VAR(json, new MJson, 0); +DECLARE_CLASS_VAR(json, new MJson); // methods struct Json { @@ -97,7 +97,7 @@ String* json_string(Json *json, const ch String::C result = json->charset !=NULL ? Charset::transcode(String::C(value, length), UTF8_charset, *json->charset) : String::C(pa_strdup(value, length), length); - return new String(result.str, json->taint, result.length); + return new String(result, json->taint); } static Value *json_hook(Request &r, Junction *hook, String* key, Value* value){ @@ -205,7 +205,7 @@ static const char* json_error_message(in "nesting limit", "data limit", "comment not allowed by config", - "unexpected char", + "unexpected character", "missing unicode low surrogate", "unexpected unicode low surrogate", "error comma out of structure", @@ -216,6 +216,67 @@ static const char* json_error_message(in extern String::Language get_untaint_lang(const String& lang_name); +#define SOURCE_MAX_LEN 60 + +void json_exception_with_source(Request& r, const char* msg, const char* json, int offset){ + int i; + + int line=0; + int start=0; + int end=strlen(json); + + if(offset>end) + offset=end; + + for(i = 0; i < offset; i++){ + if(json[i]=='\n'){ + line++; + } + } + + if(offset > SOURCE_MAX_LEN/2) + start = offset - SOURCE_MAX_LEN/2; + + for(i = offset-1; i>=start; i--){ + if(json[i]=='\n'){ + start=i+1; + break; + } + } + + if(start+SOURCE_MAX_LEN < end) + end=start+SOURCE_MAX_LEN; + + for(i = offset+1; i0){ + String s_source(pa_strdup(source,source_offset)); + source_offset=s_source.length(r.charsets.source()); + } + } + + throw Exception("json.parse", 0, "%s at line %d\n%s\n%*s", msg, line+1, source, source_offset+1, "^"); +} + static void _parse(Request& r, MethodParams& params) { const String& json_string=params.as_string(0, "json must be string"); @@ -282,13 +343,20 @@ static void _parse(Request& r, MethodPar if(int result = json_parser_init(&parser, &config, (json_parser_callback)&json_callback, &json)) throw Exception("json.parse", 0, "%s", json_error_message(result)); + if(!*json_cstr) + throw Exception("json.parse", 0, "empty string is not valid json"); + + const char *first_quote=strchr(json_cstr,'"'); + if(first_quote && first_quote>json_cstr && *(--first_quote) == '\\') + json_exception_with_source(r, "illegal quote escape, json may be tainted", json_cstr, first_quote-json_cstr); + uint32_t processed; if(int result = json_parser_string(&parser, json_cstr, strlen(json_cstr), &processed)) - throw Exception("json.parse", 0, "%s at byte %d", json_error_message(result), processed); + json_exception_with_source(r, json_error_message(result), json_cstr, processed); if (!json_parser_is_done(&parser)) - throw Exception("json.parse", 0, "unexpected end of json data"); - + json_exception_with_source(r, "unexpected end of json data", json_cstr, processed); + json_parser_free(&parser); if (json.result) r.write_no_lang(*json.result); @@ -322,8 +390,8 @@ public: const String& value_json_string(String::Body key, Value& v, Json_options& options); -const String* Json_options::hash_json_string(HashStringValue &hash) { - if(!hash.count()) +const String* Json_options::hash_json_string(HashStringValue *hash) { + if(!hash || !hash->count()) return new String("{}", String::L_AS_IS); Json_string_recoursion go_down(*this); @@ -334,7 +402,7 @@ const String* Json_options::hash_json_st String *delim=NULL; indent=get_indent(json_string_recoursion); - for(HashStringValue::Iterator i(hash); i; i.next() ){ + for(HashStringValue::Iterator i(*hash); i; i.next() ){ if (delim){ result << *delim; } else { @@ -348,7 +416,7 @@ const String* Json_options::hash_json_st } else { bool need_delim=false; - for(HashStringValue::Iterator i(hash); i; i.next() ){ + for(HashStringValue::Iterator i(*hash); i; i.next() ){ result << (need_delim ? ",\n\"" : "\""); result << String(i.key(), String::L_JSON) << "\":" << value_json_string(i.key(), *i.value(), *this); need_delim=true; @@ -369,7 +437,7 @@ const String& value_json_string(String:: Value* method=options.methods->get(v.type()); if(!method){ method=options.methods->first_that(based_on, &v); - options.methods->put(key, method ? method : VVoid::get()); + options.methods->put(v.type(), method ? method : VVoid::get()); } if(method && !method->is_void()) { Junction* junction=method->get_junction(); @@ -409,7 +477,7 @@ static void _string(Request& r, MethodPa } else if(key == "date" && value->is_string()){ const String& svalue=value->as_string(); if(!json.set_date_format(svalue)) - throw Exception(PARSER_RUNTIME, &svalue, "must be 'sql-string', 'gmt-string' or 'unix-timestamp'"); + throw Exception(PARSER_RUNTIME, &svalue, "must be 'sql-string', 'gmt-string', 'iso-string' or 'unix-timestamp'"); valid_options++; } else if(key == "indent"){ if(value->is_string()){ @@ -427,6 +495,11 @@ static void _string(Request& r, MethodPa if(!json.set_file_format(svalue)) throw Exception(PARSER_RUNTIME, &svalue, "must be 'base64', 'text' or 'stat'"); valid_options++; + } else if(key == "void" && value->is_string()){ + const String& svalue=value->as_string(); + if(!json.set_void_format(svalue)) + throw Exception(PARSER_RUNTIME, &svalue, "must be 'string' or 'null'"); + valid_options++; #ifdef XML } else if(key == "xdoc" && (vvalue = value->get_hash())){ json.xdoc_options=new XDocOutputOptions(); @@ -447,9 +520,11 @@ static void _string(Request& r, MethodPa // special handling for $._default if(VHash* vhash=static_cast(params[1].as(VHASH_TYPE))) if(Value* value=vhash->get_default()) { + if(!value->is_string()){ Junction* junction=value->get_junction(); if(!junction || !junction->method || !junction->method->params_names || junction->method->params_names->count() != 3) - throw Exception(PARSER_RUNTIME, 0, "$.%s must be parser method with 3 parameters", HASH_DEFAULT_ELEMENT_NAME); + throw Exception(PARSER_RUNTIME, 0, "$._default must be string or parser method with 3 parameters"); + } json.default_method=value; } @@ -457,7 +532,7 @@ static void _string(Request& r, MethodPa json.methods=methods; } - const String& result_string=value_json_string(String::Body(), params[0], json); + const String& result_string=value_json_string(String::Body(), r.process_to_value(params[0]), json); String::Body result_body=result_string.cstr_to_string_body_untaint(String::L_JSON, r.connection(false), &r.charsets); r.write_pass_lang(*new String(result_body, String::L_AS_IS)); }