Skip to content

fix(json): do not HTML-escape <, > and & in JSON output - #556

Open
Sanjays2402 wants to merge 1 commit into
TomWright:masterfrom
Sanjays2402:fix/json-writer-html-escaping
Open

fix(json): do not HTML-escape <, > and & in JSON output#556
Sanjays2402 wants to merge 1 commit into
TomWright:masterfrom
Sanjays2402:fix/json-writer-html-escaping

Conversation

@Sanjays2402

Copy link
Copy Markdown

Closes #552

json.Marshal escapes <, > and & as \u003c, \u003e and \u0026 so the result is safe to embed directly in HTML. dasel writes to files and stdout, so that escaping only makes the output harder to read — dasel -i toml -o json turned "setuptools>=77.0.3" into "setuptools\u003e=77.0.3".

The writer's encoder now uses json.NewEncoder with SetEscapeHTML(false) (trimming the newline Encode appends). TestJsonDoesNotEscapeHTMLCharacters round-trips a string containing <, > and &; it fails on the previous behaviour and passes with the fix. go test ./... is green, and a CHANGELOG entry is included.

This change was prepared with AI assistance; the regression test was run locally and fails without the fix.

json.Marshal escapes <, > and & as \u003c, \u003e and \u0026 so that the
result is safe to embed directly in HTML. dasel writes to files and
stdout, where that escaping only makes the output harder to read: piping
a pyproject.toml through 'dasel -i toml -o json' turned
"setuptools>=77.0.3" into "setuptools\u003e=77.0.3".

The writer's encoder now uses json.NewEncoder with SetEscapeHTML(false),
trimming the newline Encode appends.

Adds TestJsonDoesNotEscapeHTMLCharacters, which round-trips a string
containing <, > and & and fails on the previous behaviour.

Closes TomWright#552
@TomWright

Copy link
Copy Markdown
Owner

Thank you for the contribution!

Could we add a flag here to allow users to toggle this functionality?

I'm happy with it skipping HTML encoding by default, but it would be good to keep it available for those that need it.

An example of a format specific flat is here:

dasel/parsing/csv/csv.go

Lines 20 to 28 in 70fd28f

func newCSVWriter(options parsing.WriterOptions) (parsing.Writer, error) {
w := &csvWriter{
separator: ',',
}
if v, ok := options.Ext["csv-delimiter"]; ok && v != "" {
w.separator = rune(v[0])
}
return w, nil
}

Something along the lines of json-escape with a value of html should keep escaping

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

> escaped in TOML in JSON output

2 participants