From b3a49b161a6192d4b8c574f0cd7f9b16567cd834 Mon Sep 17 00:00:00 2001
From: Kaz Kylheku <kaz@kylheku.com>
Date: Sat, 29 May 2021 07:26:19 -0700
Subject: json: escape slash in </ sequence

* lib.c (out_json_str): When the < character is seen, if the
lookahead character is /, output the < and a backslash to
escape the /.

* txr.1: Moved description of special JSON output handling
under tojson, and described the above escaping there also.
---
 lib.c |  5 +++++
 txr.1 | 44 +++++++++++++++++++++++++++++++-------------
 2 files changed, 36 insertions(+), 13 deletions(-)

diff --git a/lib.c b/lib.c
index 75cbc739..aafc933a 100644
--- a/lib.c
+++ b/lib.c
@@ -12592,6 +12592,11 @@ static void out_json_str(val str, val out)
     case '\t':
       put_string(lit("\\t"), out);
       break;
+    case '<':
+      put_char(chr(ch), out);
+      if (*cstr == '/')
+        put_char(chr('\\'), out);
+      break;
     case 0xDC00:
       put_string(lit("\\u0000"), out);
       break;
diff --git a/txr.1 b/txr.1
index 39afba58..b9196a05 100644
--- a/txr.1
+++ b/txr.1
@@ -12417,7 +12417,11 @@ symbol is bound as a macro, which is expanded when a
 .code #J
 expression is evaluated.
 
-The following extensions to JSON are supported.
+The following remarks indicate special treatment and extensions in the
+processing of JSON. Similar remarks regarding the production of JSON are
+given under the
+.code tojson
+function.
 
 When an invalid UTF-8 byte is encountered inside a JSON string, its value is
 mapped into the code point range U+DC01 to U+DCFF. That byte is consumed, and
@@ -12431,18 +12435,6 @@ The JSON escape sequence
 .code "\eu0000"
 denoting the U+0000 NUL character is also converted to U+DC00.
 
-When a JSON string is output, any code points U+DC01 through U+DCFF occurring
-in that string are assumed to denote raw bytes to be output, without
-escaping. The code point U+DC00 produces the
-.code "\eu0000"
-escape syntax. This behavior is different from \*(TL literals, which, on
-output, simply render these code points using
-.code "\ex"
-escape sequences. Rationale: this is because JSON is considered an external format.
-The requirements are intended to reproduce the original byte sequence, if
-possible, rather than JSON syntax which will produce the same \*(TX object
-if read back by \*(TX.
-
 \*(TL does not impose the restriction that the keys in a JSON object
 must be strings:
 .code "#J{1:2,true:false}"
@@ -71917,6 +71909,32 @@ Otherwise, the JSON is potentially subject to such formatting.
 
 Even if the JSON data contains line breaks, it does not end in a line break.
 
+When a JSON string is output, any code points U+DC01 through U+DCFF occurring
+in that string are assumed to denote raw bytes to be output, without
+escaping. The code point U+DC00 produces the
+.code "\eu0000"
+escape syntax. This behavior is different from \*(TL literals, which, on
+output, simply render these code points using
+.code "\ex"
+escape sequences. Rationale: this is because JSON is considered an external format.
+The requirements are intended to reproduce the original byte sequence, if
+possible, rather than JSON syntax which will produce the same \*(TX object
+if read back by \*(TX.
+
+If the character sequence
+.code "</"
+occurs in the string, the slash is escaped, such that the sequence
+is rendered as
+.codn "<\e/" .
+Instances of the
+.code /
+(forward slash, solidus) occurs not preceded by
+.code <
+(less than) are unescaped. Rationale: this allows for safe embedding
+of the resulting JSON into HTML
+.code script
+tags.
+
 .coNP Function @ get-json
 .synb
 .mets (get-json >> [ source
-- 
cgit v1.2.3