Skip to content

HTML-encode the JSON response based on the content type #7385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
labkey-jeckels wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

HTML-encode the JSON response based on the content type #7385

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4712db5
HTML-encode the JSON response based on the content type
labkey-jeckels Feb 3, 2026
2016278
Merge branch 'develop' into fb_extJsonHtmlResponse
labkey-jeckels Feb 5, 2026
780e22b
Catch another couple of possible strings
labkey-jeckels Feb 5, 2026
5e258a3
Fix variable name
labkey-jeckels Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions api/src/org/labkey/api/action/ApiJsonWriter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,11 +169,21 @@ public void writeProperty(String name, Object value) throws IOException
writeObject(value);
}

/** Let subclasses have a chance to do special handling on String values in the response */
protected void writeString(String value) throws IOException
{
jg.writeString(value);
}

@Override
protected void writeObject(Object value) throws IOException
{
ensureNotClosed();
if (value instanceof String || value instanceof Number || value instanceof Boolean || value == null)
if (value instanceof String s)
{
writeString(s);
}
else if (value instanceof Number || value instanceof Boolean || value == null)
{
jg.writeObject(value);
}
Expand Down Expand Up @@ -224,9 +234,9 @@ else if (value instanceof JSONArray jsonArray) // TODO: replace the upstream cre
jg.writeEndArray();
}
}
else if (value instanceof Date)
else if (value instanceof Date d)
{
jg.writeString(DateUtil.formatJsonDateTime((Date) value));
writeString(DateUtil.formatJsonDateTime(d));
}
// Always use Jackson serialization for SimpleResponse, Issue 47216
else if (isSerializeViaJacksonAnnotations() || value instanceof SimpleResponse<?>)
Expand All @@ -239,7 +249,7 @@ else if (value == JSONObject.NULL)
}
else
{
jg.writeString(value.toString());
writeString(value.toString());
}
}

Expand Down
33 changes: 19 additions & 14 deletions api/src/org/labkey/api/action/ExtFormResponseWriter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
import org.labkey.api.query.PropertyValidationError;
import org.labkey.api.query.ValidationError;
import org.labkey.api.query.ValidationException;
import org.labkey.api.util.PageFlowUtil;
import org.springframework.validation.Errors;
import org.springframework.validation.FieldError;
import org.springframework.validation.ObjectError;
Expand All @@ -29,12 +30,6 @@
import java.io.IOException;
import java.io.Writer;

/*
* User: Dave
* Date: Sep 3, 2008
* Time: 11:03:32 AM
*/

/**
* This writer extends ApiJsonWriter by writing validation errors in the format
* that Ext forms require.
Expand Down Expand Up @@ -92,6 +87,19 @@ public ExtFormResponseWriter(HttpServletRequest request, HttpServletResponse res
response.setContentType(contentTypeOverride);
}

@Override
public void writeProperty(String name, Object value) throws IOException
{
// writeObject() will have a chance to encode the value
super.writeProperty(sendHtmlJsonResponse ? PageFlowUtil.filter(name) : name, value);
Copy link
Contributor

@labkey-adam labkey-adam Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe a comment here to the effect that super.writeProperty() calls writeObject() which encodes

}

@Override
protected void writeString(String value) throws IOException
{
super.writeString(sendHtmlJsonResponse ? PageFlowUtil.filter(value) : value);
}

@Override
public JSONObject toJSON(ValidationException e)
{
Expand Down Expand Up @@ -121,8 +129,8 @@ public void toJSON(JSONObject jsonErrors, ValidationError error)
{
String msg = error.getMessage();
String key = "_form";
if (error instanceof PropertyValidationError)
key = ((PropertyValidationError)error).getProperty();
if (error instanceof PropertyValidationError pve)
key = pve.getProperty();
if (jsonErrors.has(key))
msg = jsonErrors.get(key) + "; " + msg;
jsonErrors.put(key, msg);
Expand All @@ -139,8 +147,8 @@ public void writeResponse(Errors errors) throws IOException
if (message == null)
message = msg;
String key = "_form";
if (error instanceof FieldError)
key = ((FieldError)error).getField();
if (error instanceof FieldError fieldError)
key = fieldError.getField();
if (jsonErrors.has(key))
msg = jsonErrors.get(key) + "; " + msg;
jsonErrors.put(key, msg);
Expand Down Expand Up @@ -174,10 +182,7 @@ protected Writer getWriter()
{
w.write("<html><body><textarea>");
}
catch (IOException x)
{

}
catch (IOException ignored) {}
}
return w;
}
Expand Down