rapture icon indicating copy to clipboard operation
rapture copied to clipboard

Validate against invalid control characters in interpolated strings.

Open mnd999 opened this issue 7 years ago • 2 comments

I hit an issue in a production system with this string using the jawn backend:

scala> json"""{"description":" "}"""
java.util.NoSuchElementException: None.get
  at scala.None$.get(Option.scala:347)
  at scala.None$.get(Option.scala:345)
  ... 29 elided

scala> """" """".getBytes()
res16: Array[Byte] = Array(34, 32, 11, 34)

Some further testing was done, and this issue was definitely jawn related. Looks like it works on Json4s and Argonaut, but seems to fail for the others. Jackson actually gives a useful exception which says that the control character 11 needs to be escaped with a backslash. Jackson is right, according to RFC7159 (https://tools.ietf.org/html/rfc7159#page-8), this should be escaped.

Rapture should take a conservative stance on what is allowed inside an interpolated string. So making that a compile error would be better.

mnd999 avatar Mar 29 '17 20:03 mnd999

This is actually worse that I thought, because you can do this:

scala> val testStr = "{\"test\":\"Hello, \\u000b\"}"
testStr: String = {"test":"Hello, \u000b"}

scala> Json.parse(testStr)
res33: rapture.json.Json = json"""{"test":"Hello, "}"""

scala> json"""{"Hello": $res33 }"""
java.util.NoSuchElementException: None.get

mnd999 avatar Mar 30 '17 09:03 mnd999

Yeah, that's definitely a Rapture issue with the substitution. If I recall correctly, it serializes res33 to a String then substitutes it into the expression. This means that the serialization is wrong.

propensive avatar Mar 30 '17 09:03 propensive