qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-17 14:14:56 -07:00
Code Releases Activity

encoding/json: document HTML escaping in Compact

Browse Source 
Make explicit that Compact does HTML escaping.

Fixes #30357.

Change-Id: I4648f8f3e907d659db977d07253f716df6e07d7b
Reviewed-on: https://go-review.googlesource.com/c/go/+/173417
Run-TryBot: Russ Cox <rsc@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This commit is contained in:
Russ Cox 2019-04-23 07:27:07 -04:00
parent b51c157025
commit d92bc7a55a
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/encoding/json/encode.go
View File

@ -45,11 +45,12 @@ import (
//
// String values encode as JSON strings coerced to valid UTF-8,
// replacing invalid bytes with the Unicode replacement rune.
// The angle brackets "<" and ">" are escaped to "\u003c" and "\u003e"
// to keep some browsers from misinterpreting JSON output as HTML.
// Ampersand "&" is also escaped to "\u0026" for the same reason.
// This escaping can be disabled using an Encoder that had SetEscapeHTML(false)
// called on it.
// So that the JSON will be safe to embed inside HTML <script> tags,
// the string is encoded using HTMLEscape,
// which replaces "<", ">", "&", U+2028, and U+2029 are escaped
// to "\u003c","\u003e", "\u0026", "\u2028", and "\u2029".
// This replacement can be disabled when using an Encoder,
// by calling SetEscapeHTML(false).
//
// Array and slice values encode as JSON arrays, except that
// []byte encodes as a base64-encoded string, and a nil slice

3
src/encoding/json/indent.go
View File

@ -8,6 +8,9 @@ import "bytes"
// Compact appends to dst the JSON-encoded src with
// insignificant space characters elided.
// Like Marshal, Compact applies HTMLEscape to any
// string literals so that the JSON will be safe to embed
// inside HTML <script> tags.
func Compact(dst *bytes.Buffer, src []byte) error {
return compact(dst, src, false)
}