Clojurians Log v2

You might need to escape JSON anyway if it contains user data. For example, a string could contain </script> which would close the script tag and the rest of JSON would be part of HTML. HTML encoding and decoding of JSON should be straightforward.

Either it's a valid JSON that contains </script> in a string, or it's an invalid JSON. In the former case, it's not a problem. In the latter case, you have other problems. :)

This is not true. When a browser parses HTML, it encounters starting <script> tag and then it scans till it finds a matching </script> tag. It does not care whether JSON is valid or not. For example, see https://stackoverflow.com/questions/39193510/how-to-insert-arbitrary-json-in-htmls-script-tag. I had a similar issue in OrgPad code, where we store document data inside script tag using transit+json. Originally, we did not escape it, till one user was creating a document about HTML and JS, and it was loaded broken since the document contained the string </script> somewhere.

Decoding HTML encoded strings is straightforward, for example using the following code:

(def ^:private escape-sequences-dict
  "A sequence of pairs which are applied in the order from  left to right
  when replacing escape sequences with escaped characters and in the
  opposite order for the opposite conversion."
  [["<" "<"] [">" ">"] [""" "\""]
   ["'" "'"] ["'" "'"] ["&" "&"]])

(defn decode
  "Replaces escape sequences with escaped characters, so original string can
  be recovered from HTML."
  [s]
  (reduce (fn [string [escape replacement]]
            (str/replace string escape replacement))
          s escape-sequences-dict))

(defn encode
  "Replaces escaped characters in a string with their escape sequences,
  so they can be safely inserted inside HTML."
  [s]
  (reduce (fn [string [escape replacement]]
            (str/replace string replacement escape))
          s (reverse escape-sequences-dict)))

Oh, huh... Thanks for correcting my understanding. Perhaps some escaping is due.

I was surprised by that a few months back as well 🙂.

yolo https://cljdoc.org/d/reagent/reagent/1.2.0/doc/frequently-asked-questions/how-can-i-use-react-s-dangerouslysetinnerhtml-

Hold on, what do you need to escape? JSON doesn't have anything that would interfere with HTML. I just tried adding [:script {:type "application/json"} "{\"hello\": \"there\"}"] to a page, in the DOM it looks like <script type="application/json">{"hello": "there"}</script> - nothing is escaped.

well

(rdom/render-to-static-markup [:script {:type "application/json"} "{\"hi\":3"])
"<script type=\"application/json\">{&quot;hi&quot;:3</script>"

Weird, seems that that function works differently from what React does in its regular mode. Also, on my end I get < turned into \x3C. But why do you need that function? I don't think I've ever seen it being used.

To generate HTML in a vscode extension to ship to the frontend. Seemed nicer than rawdogging strings but then I guess I just defeated any added security by dangerously setting innerhtml

Hmm. Seems like it's exactly what you're supposed to do: https://github.com/facebook/react/issues/4446#issuecomment-123417310 Albeit the comment is from 8 years ago. But given that you know that the content is JSON (BTW you missed } in the example), you can build the string by plain concatenation - no need for React here at all.

I do a similar thing when I need to deliver complex static payload with HTML that can't be a part of the JS bundle, albeit I use Selmer or Hiccup and Transit instead of JSON.

Fun