Use JSONEncoderForHTML when preparing JSON fragments for pages

Bug #684430 reported by Gavin Panella
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Launchpad itself
Fix Released
Critical
William Grant
lazr.restful
Fix Released
Critical
William Grant

Bug Description

When reviewing lp:~sinzui/launchpad/closed-teams-0 I said that we
should use JSONEncoderForHTML in preference to the default JSONEncoder
class in simplejson.

From http://code.google.com/p/simplejson/issues/detail?id=66:

  To embed JSON content in, say, a script tag on a web page, the
  characters &, < and > should be escaped. They cannot be escaped with
  the usual entities (e.g. &amp;) because they are not expanded within
  <script> tags.

However, in that review sinzui noted that we "cannot do this right now
because Lp is using 2.0.9".

It doesn't seem to be causing us any problems right now, but the
nature of the issue is such that it could be causing subtle problems
that we might ascribe to other things.

We should probably switch to using JSONEncoderForHTML everywhere we
prepare page fragments, create a simple helper to make it as easy to
use as simplejson.dumps() is, and publicise the change to the team.

Related branches

Gary Poster (gary)
Changed in launchpad-foundations:
status: New → Triaged
importance: Undecided → High
Revision history for this message
William Grant (wgrant) wrote :

lazr.restful's ResourceJSONEncoder should inherit from JSONEncoderForHTML, and most of LP's JSON encoding should probably use the webservice:json formatter.

Changed in launchpad:
importance: High → Critical
assignee: nobody → William Grant (wgrant)
status: Triaged → In Progress
William Grant (wgrant)
Changed in lazr.restful:
importance: Undecided → Critical
assignee: nobody → William Grant (wgrant)
status: New → In Progress
William Grant (wgrant)
Changed in lazr.restful:
status: In Progress → Fix Committed
William Grant (wgrant)
Changed in lazr.restful:
status: Fix Committed → Fix Released
Changed in launchpad:
status: In Progress → Fix Released
Changed in lazr.restful:
milestone: none → 0.18.1
Changed in launchpad:
milestone: none → 11.05
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.