rapture
rapture copied to clipboard
Validate against invalid control characters in interpolated strings.
I hit an issue in a production system with this string using the jawn backend:
scala> json"""{"description":" "}"""
java.util.NoSuchElementException: None.get
at scala.None$.get(Option.scala:347)
at scala.None$.get(Option.scala:345)
... 29 elided
scala> """" """".getBytes()
res16: Array[Byte] = Array(34, 32, 11, 34)
Some further testing was done, and this issue was definitely jawn related. Looks like it works on Json4s and Argonaut, but seems to fail for the others. Jackson actually gives a useful exception which says that the control character 11 needs to be escaped with a backslash. Jackson is right, according to RFC7159 (https://tools.ietf.org/html/rfc7159#page-8), this should be escaped.
Rapture should take a conservative stance on what is allowed inside an interpolated string. So making that a compile error would be better.
This is actually worse that I thought, because you can do this:
scala> val testStr = "{\"test\":\"Hello, \\u000b\"}"
testStr: String = {"test":"Hello, \u000b"}
scala> Json.parse(testStr)
res33: rapture.json.Json = json"""{"test":"Hello, "}"""
scala> json"""{"Hello": $res33 }"""
java.util.NoSuchElementException: None.get
Yeah, that's definitely a Rapture issue with the substitution. If I recall correctly, it serializes res33
to a String
then substitutes it into the expression. This means that the serialization is wrong.