Skip to content

HTML-encode the JSON response based on the content type #7385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
labkey-jeckels merged 7 commits into from
Feb 14, 2026
Merged

HTML-encode the JSON response based on the content type #7385

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4712db5
HTML-encode the JSON response based on the content type
labkey-jeckels Feb 3, 2026
2016278
Merge branch 'develop' into fb_extJsonHtmlResponse
labkey-jeckels Feb 5, 2026
780e22b
Catch another couple of possible strings
labkey-jeckels Feb 5, 2026
5e258a3
Fix variable name
labkey-jeckels Feb 5, 2026
489f330
Switch to writer-based HTML encoding
labkey-jeckels Feb 13, 2026
df0abbe
Avoid wrapping content
labkey-jeckels Feb 13, 2026
c7d3be7
Ensure Content-Type is set in time
labkey-jeckels Feb 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 25 additions & 14 deletions api/src/org/labkey/api/action/ExtFormResponseWriter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
import org.labkey.api.query.PropertyValidationError;
import org.labkey.api.query.ValidationError;
import org.labkey.api.query.ValidationException;
import org.labkey.api.util.PageFlowUtil;
import org.springframework.validation.Errors;
import org.springframework.validation.FieldError;
import org.springframework.validation.ObjectError;
Expand All @@ -29,12 +30,6 @@
import java.io.IOException;
import java.io.Writer;

/*
* User: Dave
* Date: Sep 3, 2008
* Time: 11:03:32 AM
*/

/**
* This writer extends ApiJsonWriter by writing validation errors in the format
* that Ext forms require.
Expand Down Expand Up @@ -92,6 +87,25 @@ public ExtFormResponseWriter(HttpServletRequest request, HttpServletResponse res
response.setContentType(contentTypeOverride);
}

@Override
public void writeProperty(String name, Object value) throws IOException
{
super.writeProperty(sendHtmlJsonResponse ? PageFlowUtil.filter(name) : name, value);
Copy link
Copy Markdown
Contributor

@labkey-adam labkey-adam Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe a comment here to the effect that super.writeProperty() calls writeObject() which encodes

}

@Override
protected void writeObject(Object value) throws IOException
{
if (value instanceof String s && sendHtmlJsonResponse)
{
super.writeObject(PageFlowUtil.filter(s));
}
else
{
super.writeObject(value);
Copy link
Copy Markdown
Contributor

@labkey-adam labkey-adam Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So all non-String values are safe to render without encoding?

Copy link
Copy Markdown
Contributor Author

@labkey-jeckels labkey-jeckels Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In practice, yes. But there are other possible values that could end up rendering as strings. I was able to change the override approach to catch more of those theoretical pathways. I didn't see a way to intercept this line though:

        else if (isSerializeViaJacksonAnnotations() || value instanceof SimpleResponse<?>)

Copy link
Copy Markdown
Contributor

@labkey-matthewb labkey-matthewb Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If everything is supposed to be encoded, could this be tackled from the stream side?

Copy link
Copy Markdown
Contributor

@labkey-matthewb labkey-matthewb Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If everything is supposed to be encoded, could this be tackled from the stream side?

Copy link
Copy Markdown
Contributor Author

@labkey-jeckels labkey-jeckels Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I refactored to an encoding Writer

}
}

@Override
public JSONObject toJSON(ValidationException e)
{
Expand Down Expand Up @@ -121,8 +135,8 @@ public void toJSON(JSONObject jsonErrors, ValidationError error)
{
String msg = error.getMessage();
String key = "_form";
if (error instanceof PropertyValidationError)
key = ((PropertyValidationError)error).getProperty();
if (error instanceof PropertyValidationError pve)
key = pve.getProperty();
if (jsonErrors.has(key))
msg = jsonErrors.get(key) + "; " + msg;
jsonErrors.put(key, msg);
Expand All @@ -139,8 +153,8 @@ public void writeResponse(Errors errors) throws IOException
if (message == null)
message = msg;
String key = "_form";
if (error instanceof FieldError)
key = ((FieldError)error).getField();
if (error instanceof FieldError fieldError)
key = fieldError.getField();
if (jsonErrors.has(key))
msg = jsonErrors.get(key) + "; " + msg;
jsonErrors.put(key, msg);
Expand Down Expand Up @@ -174,10 +188,7 @@ protected Writer getWriter()
{
w.write("<html><body><textarea>");
}
catch (IOException x)
{

}
catch (IOException ignored) {}
}
return w;
}
Expand Down