Skip to content
This repository has been archived by the owner on Aug 20, 2018. It is now read-only.

Escape Newline/Paragraph separators #18

Merged

Conversation

ajhyndman
Copy link
Contributor

I think that the Webpack JSON loader seems like the right place to handle
this issue.

For whatever reason, the JSON and Javascript specifications disagree on
whether or not strings can contain the unicode Newline or Paragraph
characters.

In the case that a JSON object containing one or more of these characters is
being printed to a script tag, we should escape them.

See also this discussion:
expressjs/express#1132 (comment)

@laughinghan
Copy link

@ajhyndman
Copy link
Contributor Author

Demo of a failing import:
http://www.webpackbin.com/VJAVHKdCe

Click on "Log" at the top left to see the error generated.
Delete or escape the character "\u2028" from illegal.json
to see the expected behaviour.

@graingert
Copy link

@ajhyndman you should rebase and sign the CLA

@laughinghan
Copy link

Christ. @ajhyndman: I'm happy to do it if you give me push access to your fork

index.js Outdated
return "module.exports = " +
JSON.stringify(value, undefined, "\t")
.replace(/\u2028/g, '\\u2028')
.replace(/\u2029/g, '\\u2029') +
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

replace with string replaces only once. You need the regexp with g flag.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh my goodness how did I not know that, that's really surprising

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sorry, thought I was in Python land

@ajhyndman
Copy link
Contributor Author

@laughinghan Sure, thanks!

@laughinghan
Copy link

@ajhyndman: you gotta give me push access to your fork though

I think that the Webpack JSON loader seems like the right place to handle 
this issue.

For whatever reason, the JSON and Javascript specifications disagree on
whether or not strings can contain the unicode Newline or Paragraph 
characters.

In the case that a JSON object containing one of these characters is being
printed to a script tag, we should escape them.

See also, this discussion:
expressjs/express#1132 (comment)
@laughinghan
Copy link

@graingert @sokra Rebased!

@michael-ciniawsky
Copy link
Member

@ajhyndman Can you please close and reopen the PR to trigger the CLA Bot again ? 😛

@laughinghan
Copy link

laughinghan commented Mar 14, 2017

@ajhyndman: I don't think you need to do that, just go to https://cla.js.foundation/webpack-contrib/json-loader?pullRequest=18 and sign it and come back and I'd expect it to update

(I've just done so, but I'm committer, you're author)

Copy link

@bebraw bebraw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Better with tests.

@graingert
Copy link

@bebraw Sure, but there are no existing tests here. it's unreasonable to expect a contributor to write the whole testing infrastructure.

@bebraw
Copy link

bebraw commented Mar 14, 2017

@graingert Ah, yeah. Fair point. Two options:

  1. We'll accept the PR now without tests.
  2. We'll accept the PR with tests after integrating webpack-defaults to the projects. That gives the testing infrastructure needed.

@michael-ciniawsky
Copy link
Member

@bebraw I'm working on various webpack-defaults upgrades for the 'smaller' loaders, but it will take a few days, it's not best pratice by any means but @graingert has a point here, since there isn't any test setup provided for contribs, we can always revert this change if the issue tracker blows up but thats my personal opinion (I don't think so) 😛

@bebraw
Copy link

bebraw commented Mar 14, 2017

@michael-ciniawsky Yeah, it's a simple change so merge now. Easy enough to add a good test later.

@michael-ciniawsky
Copy link
Member

@ajhyndman Please close and reopen the PR to trigger the CLA Bot again , otherwise I can't merge this for legislative reasons 😛

@sokra sokra closed this Mar 14, 2017
@sokra sokra reopened this Mar 14, 2017
@jsf-clabot
Copy link

jsf-clabot commented Mar 14, 2017

CLA assistant check
All committers have signed the CLA.

@michael-ciniawsky
Copy link
Member

@ajhyndman ping 😛

@ajhyndman
Copy link
Contributor Author

Sorry! Signed, and fixed up merge conflicts.

Copy link
Member

@michael-ciniawsky michael-ciniawsky left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@michael-ciniawsky michael-ciniawsky merged commit 3b3069f into webpack-contrib:master Mar 17, 2017
@joshwiens joshwiens self-assigned this Mar 18, 2017
sokra added a commit that referenced this pull request May 7, 2017
bmeurer added a commit to bmeurer/raw-loader that referenced this pull request Sep 27, 2017
Similar to webpack-contrib/json-loader#18 the `raw-loader` also needs to properly escape the special unicode characters, as otherwise `webpack` get's highly confused when it sees one of them.
bmeurer added a commit to bmeurer/raw-loader that referenced this pull request Oct 1, 2017
Similar to webpack-contrib/json-loader#18 the `raw-loader` also needs to properly escape the special unicode characters, as otherwise `webpack` get's highly confused when it sees one of them.
joshwiens pushed a commit to webpack-contrib/raw-loader that referenced this pull request Oct 2, 2017
Similar to webpack-contrib/json-loader#18 the `raw-loader` also needs to properly escape the special unicode characters, as otherwise `webpack` get's highly confused when it sees one of them.
bmeurer added a commit to bmeurer/raw-loader that referenced this pull request Oct 10, 2017
Similar to webpack-contrib/json-loader#18
the `raw-loader` also needs to properly escape the special unicode
characters, as otherwise `webpack` get's highly confused when it
sees one of them.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants