123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372 |
- package jsoniter
- import (
- "unicode/utf8"
- )
- // htmlSafeSet holds the value true if the ASCII character with the given
- // array position can be safely represented inside a JSON string, embedded
- // inside of HTML <script> tags, without any additional escaping.
- //
- // All values are true except for the ASCII control characters (0-31), the
- // double quote ("), the backslash character ("\"), HTML opening and closing
- // tags ("<" and ">"), and the ampersand ("&").
- var htmlSafeSet = [utf8.RuneSelf]bool{
- ' ': true,
- '!': true,
- '"': false,
- '#': true,
- '$': true,
- '%': true,
- '&': false,
- '\'': true,
- '(': true,
- ')': true,
- '*': true,
- '+': true,
- ',': true,
- '-': true,
- '.': true,
- '/': true,
- '0': true,
- '1': true,
- '2': true,
- '3': true,
- '4': true,
- '5': true,
- '6': true,
- '7': true,
- '8': true,
- '9': true,
- ':': true,
- ';': true,
- '<': false,
- '=': true,
- '>': false,
- '?': true,
- '@': true,
- 'A': true,
- 'B': true,
- 'C': true,
- 'D': true,
- 'E': true,
- 'F': true,
- 'G': true,
- 'H': true,
- 'I': true,
- 'J': true,
- 'K': true,
- 'L': true,
- 'M': true,
- 'N': true,
- 'O': true,
- 'P': true,
- 'Q': true,
- 'R': true,
- 'S': true,
- 'T': true,
- 'U': true,
- 'V': true,
- 'W': true,
- 'X': true,
- 'Y': true,
- 'Z': true,
- '[': true,
- '\\': false,
- ']': true,
- '^': true,
- '_': true,
- '`': true,
- 'a': true,
- 'b': true,
- 'c': true,
- 'd': true,
- 'e': true,
- 'f': true,
- 'g': true,
- 'h': true,
- 'i': true,
- 'j': true,
- 'k': true,
- 'l': true,
- 'm': true,
- 'n': true,
- 'o': true,
- 'p': true,
- 'q': true,
- 'r': true,
- 's': true,
- 't': true,
- 'u': true,
- 'v': true,
- 'w': true,
- 'x': true,
- 'y': true,
- 'z': true,
- '{': true,
- '|': true,
- '}': true,
- '~': true,
- '\u007f': true,
- }
- // safeSet holds the value true if the ASCII character with the given array
- // position can be represented inside a JSON string without any further
- // escaping.
- //
- // All values are true except for the ASCII control characters (0-31), the
- // double quote ("), and the backslash character ("\").
- var safeSet = [utf8.RuneSelf]bool{
- ' ': true,
- '!': true,
- '"': false,
- '#': true,
- '$': true,
- '%': true,
- '&': true,
- '\'': true,
- '(': true,
- ')': true,
- '*': true,
- '+': true,
- ',': true,
- '-': true,
- '.': true,
- '/': true,
- '0': true,
- '1': true,
- '2': true,
- '3': true,
- '4': true,
- '5': true,
- '6': true,
- '7': true,
- '8': true,
- '9': true,
- ':': true,
- ';': true,
- '<': true,
- '=': true,
- '>': true,
- '?': true,
- '@': true,
- 'A': true,
- 'B': true,
- 'C': true,
- 'D': true,
- 'E': true,
- 'F': true,
- 'G': true,
- 'H': true,
- 'I': true,
- 'J': true,
- 'K': true,
- 'L': true,
- 'M': true,
- 'N': true,
- 'O': true,
- 'P': true,
- 'Q': true,
- 'R': true,
- 'S': true,
- 'T': true,
- 'U': true,
- 'V': true,
- 'W': true,
- 'X': true,
- 'Y': true,
- 'Z': true,
- '[': true,
- '\\': false,
- ']': true,
- '^': true,
- '_': true,
- '`': true,
- 'a': true,
- 'b': true,
- 'c': true,
- 'd': true,
- 'e': true,
- 'f': true,
- 'g': true,
- 'h': true,
- 'i': true,
- 'j': true,
- 'k': true,
- 'l': true,
- 'm': true,
- 'n': true,
- 'o': true,
- 'p': true,
- 'q': true,
- 'r': true,
- 's': true,
- 't': true,
- 'u': true,
- 'v': true,
- 'w': true,
- 'x': true,
- 'y': true,
- 'z': true,
- '{': true,
- '|': true,
- '}': true,
- '~': true,
- '\u007f': true,
- }
- var hex = "0123456789abcdef"
- // WriteStringWithHTMLEscaped write string to stream with html special characters escaped
- func (stream *Stream) WriteStringWithHTMLEscaped(s string) {
- valLen := len(s)
- stream.buf = append(stream.buf, '"')
- // write string, the fast path, without utf8 and escape support
- i := 0
- for ; i < valLen; i++ {
- c := s[i]
- if c < utf8.RuneSelf && htmlSafeSet[c] {
- stream.buf = append(stream.buf, c)
- } else {
- break
- }
- }
- if i == valLen {
- stream.buf = append(stream.buf, '"')
- return
- }
- writeStringSlowPathWithHTMLEscaped(stream, i, s, valLen)
- }
- func writeStringSlowPathWithHTMLEscaped(stream *Stream, i int, s string, valLen int) {
- start := i
- // for the remaining parts, we process them char by char
- for i < valLen {
- if b := s[i]; b < utf8.RuneSelf {
- if htmlSafeSet[b] {
- i++
- continue
- }
- if start < i {
- stream.WriteRaw(s[start:i])
- }
- switch b {
- case '\\', '"':
- stream.writeTwoBytes('\\', b)
- case '\n':
- stream.writeTwoBytes('\\', 'n')
- case '\r':
- stream.writeTwoBytes('\\', 'r')
- case '\t':
- stream.writeTwoBytes('\\', 't')
- default:
- // This encodes bytes < 0x20 except for \t, \n and \r.
- // If escapeHTML is set, it also escapes <, >, and &
- // because they can lead to security holes when
- // user-controlled strings are rendered into JSON
- // and served to some browsers.
- stream.WriteRaw(`\u00`)
- stream.writeTwoBytes(hex[b>>4], hex[b&0xF])
- }
- i++
- start = i
- continue
- }
- c, size := utf8.DecodeRuneInString(s[i:])
- if c == utf8.RuneError && size == 1 {
- if start < i {
- stream.WriteRaw(s[start:i])
- }
- stream.WriteRaw(`\ufffd`)
- i++
- start = i
- continue
- }
- // U+2028 is LINE SEPARATOR.
- // U+2029 is PARAGRAPH SEPARATOR.
- // They are both technically valid characters in JSON strings,
- // but don't work in JSONP, which has to be evaluated as JavaScript,
- // and can lead to security holes there. It is valid JSON to
- // escape them, so we do so unconditionally.
- // See http://timelessrepo.com/json-isnt-a-javascript-subset for discussion.
- if c == '\u2028' || c == '\u2029' {
- if start < i {
- stream.WriteRaw(s[start:i])
- }
- stream.WriteRaw(`\u202`)
- stream.writeByte(hex[c&0xF])
- i += size
- start = i
- continue
- }
- i += size
- }
- if start < len(s) {
- stream.WriteRaw(s[start:])
- }
- stream.writeByte('"')
- }
- // WriteString write string to stream without html escape
- func (stream *Stream) WriteString(s string) {
- valLen := len(s)
- stream.buf = append(stream.buf, '"')
- // write string, the fast path, without utf8 and escape support
- i := 0
- for ; i < valLen; i++ {
- c := s[i]
- if c > 31 && c != '"' && c != '\\' {
- stream.buf = append(stream.buf, c)
- } else {
- break
- }
- }
- if i == valLen {
- stream.buf = append(stream.buf, '"')
- return
- }
- writeStringSlowPath(stream, i, s, valLen)
- }
- func writeStringSlowPath(stream *Stream, i int, s string, valLen int) {
- start := i
- // for the remaining parts, we process them char by char
- for i < valLen {
- if b := s[i]; b < utf8.RuneSelf {
- if safeSet[b] {
- i++
- continue
- }
- if start < i {
- stream.WriteRaw(s[start:i])
- }
- switch b {
- case '\\', '"':
- stream.writeTwoBytes('\\', b)
- case '\n':
- stream.writeTwoBytes('\\', 'n')
- case '\r':
- stream.writeTwoBytes('\\', 'r')
- case '\t':
- stream.writeTwoBytes('\\', 't')
- default:
- // This encodes bytes < 0x20 except for \t, \n and \r.
- // If escapeHTML is set, it also escapes <, >, and &
- // because they can lead to security holes when
- // user-controlled strings are rendered into JSON
- // and served to some browsers.
- stream.WriteRaw(`\u00`)
- stream.writeTwoBytes(hex[b>>4], hex[b&0xF])
- }
- i++
- start = i
- continue
- }
- i++
- continue
- }
- if start < len(s) {
- stream.WriteRaw(s[start:])
- }
- stream.writeByte('"')
- }
|