--- parser3/src/classes/json.C	2014/05/23 02:47:16	1.31
+++ parser3/src/classes/json.C	2016/10/04 13:23:46	1.46
@@ -1,7 +1,7 @@
 /** @file
 	Parser: @b json parser class.
 
-	Copyright (c) 2000-2012 Art. Lebedev Studio (http://www.artlebedev.com)
+	Copyright (c) 2000-2015 Art. Lebedev Studio (http://www.artlebedev.com)
 */
 
 #include "classes.h"
@@ -18,7 +18,7 @@
 #include "pa_vxdoc.h"
 #endif
 
-volatile const char * IDENT_JSON_C="$Id: json.C,v 1.31 2014/05/23 02:47:16 misha Exp $";
+volatile const char * IDENT_JSON_C="$Id: json.C,v 1.46 2016/10/04 13:23:46 moko Exp $";
 
 // class
 
@@ -29,7 +29,7 @@ public:
 
 // global variable
 
-DECLARE_CLASS_VAR(json, new MJson, 0);
+DECLARE_CLASS_VAR(json, new MJson);
 
 // methods
 struct Json {
@@ -95,9 +95,9 @@ static void set_json_value(Json *json, V
 
 String* json_string(Json *json, const char *value, uint32_t length){
 	String::C result = json->charset !=NULL ? 
-		Charset::transcode(String::C(value, length), UTF8_charset, *json->charset) :
+		Charset::transcode(String::C(value, length), pa_UTF8_charset, *json->charset) :
 		String::C(pa_strdup(value, length), length);
-	return new String(result.str, json->taint, result.length);
+	return new String(result, json->taint);
 }
 
 static Value *json_hook(Request &r, Junction *hook, String* key, Value* value){
@@ -107,7 +107,7 @@ static Value *json_hook(Request &r, Junc
 	frame.store_params(params, 2);
 	r.execute_method(frame);
 
-	return &frame.result().as_value();
+	return &frame.result();
 }
 
 static int json_callback(Json *json, int type, const char *value, uint32_t length)
@@ -205,7 +205,7 @@ static const char* json_error_message(in
 		"nesting limit",
 		"data limit",
 		"comment not allowed by config",
-		"unexpected char",
+		"unexpected character",
 		"missing unicode low surrogate",
 		"unexpected unicode low surrogate",
 		"error comma out of structure",
@@ -216,6 +216,67 @@ static const char* json_error_message(in
 
 extern String::Language get_untaint_lang(const String& lang_name);
 
+#define SOURCE_MAX_LEN 60
+
+void json_exception_with_source(Request& r, const char* msg, const char* json, int offset){
+	int i;
+
+	int line=0;
+	int start=0;
+	int end=strlen(json);
+
+	if(offset>end)
+		offset=end;
+
+	for(i = 0; i < offset; i++){
+		if(json[i]=='\n'){
+			line++;
+		}
+	}
+
+	if(offset > SOURCE_MAX_LEN/2)
+		start = offset - SOURCE_MAX_LEN/2;
+
+	for(i = offset-1; i>=start; i--){
+		if(json[i]=='\n'){
+			start=i+1;
+			break;
+		}
+	}
+
+	if(start+SOURCE_MAX_LEN < end)
+		end=start+SOURCE_MAX_LEN;
+
+	for(i = offset+1; i<end; i++){
+		if(json[i]=='\n'){
+			end=i;
+			break;
+		}
+	}
+
+	char *source = pa_strdup(json+start, end-start);
+	int source_offset = offset-start;
+
+	if(source[source_offset]=='\n')
+		source[source_offset]=' ';
+
+	for(i = 0; i < source_offset; i++){
+		if(source[i]=='\t'){
+			source[i]=' ';
+		}
+	}
+
+	if(r.charsets.source().isUTF8()){
+		source=(char *)fixUTF8(source);
+		if(source_offset>0){
+			String s_source(pa_strdup(source,source_offset));
+			source_offset=s_source.length(r.charsets.source());
+		}
+	}
+
+	throw Exception("json.parse", 0, "%s at line %d\n%s\n%*s", msg, line+1, source, source_offset+1, "^");
+}
+
 static void _parse(Request& r, MethodParams& params) {
 	const String& json_string=params.as_string(0, "json must be string");
 
@@ -236,15 +297,15 @@ static void _parse(Request& r, MethodPar
 		if(HashStringValue* options=params.as_hash(1)) {
 			int valid_options=0;
 			if(Value* value=options->get("depth")) {
-				config.max_nesting=r.process_to_value(*value).as_int();
+				config.max_nesting=r.process(*value).as_int();
 				valid_options++;
 			}
 			if(Value* value=options->get("double")) {
-				json.handle_double=r.process_to_value(*value).as_bool();
+				json.handle_double=r.process(*value).as_bool();
 				valid_options++;
 			}
 			if(Value* value=options->get("int")) {
-				json.handle_int=r.process_to_value(*value).as_bool();
+				json.handle_int=r.process(*value).as_bool();
 				valid_options++;
 			}
 			if(Value* value=options->get("distinct")) {
@@ -276,19 +337,26 @@ static void _parse(Request& r, MethodPar
 		}
 
 	const String::Body json_body = json_string.cstr_to_string_body_untaint(String::L_JSON, r.connection(false), &r.charsets);
-	const char *json_cstr = json.charset != NULL ? Charset::transcode(json_body, *json.charset, UTF8_charset).cstr() : json_body.cstr();
+	const char *json_cstr = json.charset != NULL ? Charset::transcode(json_body, *json.charset, pa_UTF8_charset).cstr() : json_body.cstr();
 
 	json_parser parser;
 	if(int result = json_parser_init(&parser, &config, (json_parser_callback)&json_callback, &json))
 		throw Exception("json.parse", 0, "%s", json_error_message(result));
 
+	if(!*json_cstr)
+		throw Exception("json.parse", 0, "empty string is not valid json");
+
+	const char *first_quote=strchr(json_cstr,'"');
+	if(first_quote && first_quote>json_cstr && *(--first_quote) == '\\')
+		json_exception_with_source(r, "illegal quote escape, json may be tainted", json_cstr, first_quote-json_cstr);
+
 	uint32_t processed;
 	if(int result = json_parser_string(&parser, json_cstr, strlen(json_cstr), &processed))
-		throw Exception("json.parse", 0, "%s at byte %d", json_error_message(result), processed);
+		json_exception_with_source(r, json_error_message(result), json_cstr, processed);
 
 	if (!json_parser_is_done(&parser))
-		throw Exception("json.parse", 0, "unexpected end of json data");
-	
+		json_exception_with_source(r, "unexpected end of json data", json_cstr, processed);
+
 	json_parser_free(&parser);
 
 	if (json.result) r.write_no_lang(*json.result);
@@ -322,8 +390,8 @@ public:
 
 const String& value_json_string(String::Body key, Value& v, Json_options& options);
 
-const String* Json_options::hash_json_string(HashStringValue &hash) {
-	if(!hash.count())
+const String* Json_options::hash_json_string(HashStringValue *hash) {
+	if(!hash || !hash->count())
 		return new String("{}", String::L_AS_IS);
 
 	Json_string_recoursion go_down(*this);
@@ -334,7 +402,7 @@ const String* Json_options::hash_json_st
 
 		String *delim=NULL;
 		indent=get_indent(json_string_recoursion);
-		for(HashStringValue::Iterator i(hash); i; i.next() ){
+		for(HashStringValue::Iterator i(*hash); i; i.next() ){
 			if (delim){
 				result << *delim;
 			} else {
@@ -348,7 +416,7 @@ const String* Json_options::hash_json_st
 	} else {
 
 		bool need_delim=false;
-		for(HashStringValue::Iterator i(hash); i; i.next() ){
+		for(HashStringValue::Iterator i(*hash); i; i.next() ){
 			result << (need_delim ? ",\n\"" : "\"");
 			result << String(i.key(), String::L_JSON) << "\":" << value_json_string(i.key(), *i.value(), *this);
 			need_delim=true;
@@ -404,18 +472,18 @@ static void _string(Request& r, MethodPa
 				String::Body key=i.key();
 				Value* value=i.value();
 				if(key == "skip-unknown"){
-					json.skip_unknown=r.process_to_value(*value).as_bool();
+					json.skip_unknown=r.process(*value).as_bool();
 					valid_options++;
 				} else if(key == "date" && value->is_string()){
 					const String& svalue=value->as_string();
 					if(!json.set_date_format(svalue))
-						throw Exception(PARSER_RUNTIME, &svalue, "must be 'sql-string', 'gmt-string' or 'unix-timestamp'");
+						throw Exception(PARSER_RUNTIME, &svalue, "must be 'sql-string', 'gmt-string', 'iso-string' or 'unix-timestamp'");
 					valid_options++;
 				} else if(key == "indent"){
 					if(value->is_string()){
 						json.indent=value->as_string().cstr();
 						json.json_string_recoursion=strlen(json.indent);
-					} else json.indent=r.process_to_value(*value).as_bool() ? "" : NULL;
+					} else json.indent=r.process(*value).as_bool() ? "" : NULL;
 					valid_options++;
 				} else if(key == "table" && value->is_string()){
 					const String& svalue=value->as_string();
@@ -427,6 +495,11 @@ static void _string(Request& r, MethodPa
 					if(!json.set_file_format(svalue))
 						throw Exception(PARSER_RUNTIME, &svalue, "must be 'base64', 'text' or 'stat'");
 					valid_options++;
+				} else if(key == "void" && value->is_string()){
+					const String& svalue=value->as_string();
+					if(!json.set_void_format(svalue))
+						throw Exception(PARSER_RUNTIME, &svalue, "must be 'string' or 'null'");
+					valid_options++;
 #ifdef XML
 				} else if(key == "xdoc" && (vvalue = value->get_hash())){
 					json.xdoc_options=new XDocOutputOptions();
@@ -445,11 +518,13 @@ static void _string(Request& r, MethodPa
 				throw Exception(PARSER_RUNTIME, 0, CALLED_WITH_INVALID_OPTION);
 
 			// special handling for $._default 
-			if(VHash* vhash=static_cast<VHash*>(params[1].as(VHASH_TYPE)))
+			if(VHashBase* vhash=static_cast<VHashBase*>(params[1].as(VHASH_TYPE)))
 				if(Value* value=vhash->get_default()) {
-					Junction* junction=value->get_junction();
-					if(!junction || !junction->method || !junction->method->params_names || junction->method->params_names->count() != 3)
-						throw Exception(PARSER_RUNTIME, 0, "$.%s must be parser method with 3 parameters", HASH_DEFAULT_ELEMENT_NAME);
+					if(!value->is_string()){
+						Junction* junction=value->get_junction();
+						if(!junction || !junction->method || !junction->method->params_names || junction->method->params_names->count() != 3)
+							throw Exception(PARSER_RUNTIME, 0, "$._default must be string or parser method with 3 parameters");
+					}
 					json.default_method=value;
 				}
 
@@ -457,7 +532,7 @@ static void _string(Request& r, MethodPa
 				json.methods=methods;
 		}
 
-	const String& result_string=value_json_string(String::Body(), params[0], json);
+	const String& result_string=value_json_string(String::Body(), r.process(params[0]), json);
 	String::Body result_body=result_string.cstr_to_string_body_untaint(String::L_JSON, r.connection(false), &r.charsets);
 	r.write_pass_lang(*new String(result_body, String::L_AS_IS));
  }