Flash JSON serialization emits unescaped control characters

Open
  • Is something wrong?
#650 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
c
Domain
api, backend

Research direction

Read src/sys/session/flash.c:136-149, where cwist_flash_pop_all_json() escapes flash keys and values. Add tests for control characters in both keys and values, then validate the output with a strict JSON parser. Done means the output uses valid JSON escaping for all U+0000 through U+001F characters.

Written by the indexing model from the issue text.

Description

bug good first issue

Affected: dev at bb2a33946.

cwist_flash_pop_all_json() escapes only quotes and backslashes in keys and values (src/sys/session/flash.c:136-149). Newlines, tabs, and other U+0000 through U+001F bytes are emitted literally, which violates JSON string rules in RFC 8259.

For example, a flash value first\nsecond produces a string containing a literal newline rather than \n. Strict JSON consumers reject the result.

Expected: use cJSON serialization or implement complete JSON escaping, including short escapes and \u00XX for remaining control bytes. Add tests for control characters in both keys and values and validate with a strict parser.

Dominant language
C
Stars
16
Forks
7
Avg merge
5h 39m
Merged PRs (30d)
185

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from c4punks/CWIST

All issues in c4punks/CWIST

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.