Fixed #25. Claim strings are now correctly escaped. Thanks @valentino…

…-fiorin for pointing this out! :D
GlitchedPolygons · Jan 25, 2022 · 153119f · 153119f
1 parent 47a9ce3
commit 153119f
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 3 deletions.
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -20,7 +20,7 @@ set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_LIST_DIR}/cmake" ${CMAKE_MODULE_PATH})
 
 set(L8W8JWT_MAJOR 2)
 set(L8W8JWT_MINOR 1)
-set(L8W8JWT_PATCH 4)
+set(L8W8JWT_PATCH 5)
 set(L8W8JWT_VERSION_STRING "${L8W8JWT_MAJOR}.${L8W8JWT_MINOR}.${L8W8JWT_PATCH}")
 
 option(L8W8JWT_ENABLE_TESTS "Build l8w8jwt tests." OFF)

diff --git a/src/claim.c b/src/claim.c
@@ -48,6 +48,27 @@ void l8w8jwt_free_claims(struct l8w8jwt_claim* claims, const size_t claims_count
     }
 }
 
+static inline void l8w8jwt_escape_claim_string(struct chillbuff* stringbuilder, const char* string, const size_t string_length)
+{
+    for (size_t i = 0; i < string_length; ++i)
+    {
+        const char c = string[i];
+
+        switch (c)
+        {
+            case '\\':
+                chillbuff_push_back(stringbuilder, "\\\\", 2);
+                break;
+            case '\"':
+                chillbuff_push_back(stringbuilder, "\\\"", 2);
+                break;
+            default:
+                chillbuff_push_back(stringbuilder, &c, 1);
+                break;
+        }
+    }
+}
+
 int l8w8jwt_write_claims(struct chillbuff* stringbuilder, struct l8w8jwt_claim* claims, const size_t claims_count)
 {
     if (stringbuilder == NULL || claims == NULL)
@@ -60,6 +81,12 @@ int l8w8jwt_write_claims(struct chillbuff* stringbuilder, struct l8w8jwt_claim*
         return L8W8JWT_INVALID_ARG;
     }
 
+    struct chillbuff escape_buffer;
+    if (chillbuff_init(&escape_buffer, 256, sizeof(char), CHILLBUFF_GROW_LINEAR) != 0)
+    {
+        return L8W8JWT_OUT_OF_MEM;
+    }
+
     int first = 1;
     for (struct l8w8jwt_claim* claim = claims; claim < claims + claims_count; ++claim)
     {
@@ -73,21 +100,31 @@ int l8w8jwt_write_claims(struct chillbuff* stringbuilder, struct l8w8jwt_claim*
             chillbuff_push_back(stringbuilder, ",", 1);
         }
 
+        const size_t key_length = claim->key_length ? claim->key_length : strlen(claim->key);
+        const size_t value_length = claim->value_length ? claim->value_length : strlen(claim->value);
+
+        chillbuff_clear(&escape_buffer);
+        l8w8jwt_escape_claim_string(&escape_buffer, claim->key, key_length);
+
         chillbuff_push_back(stringbuilder, "\"", 1);
-        chillbuff_push_back(stringbuilder, claim->key, claim->key_length ? claim->key_length : strlen(claim->key));
+        chillbuff_push_back(stringbuilder, escape_buffer.array, escape_buffer.length);
         chillbuff_push_back(stringbuilder, "\":", 2);
 
         if (claim->type == L8W8JWT_CLAIM_TYPE_STRING)
             chillbuff_push_back(stringbuilder, "\"", 1);
 
-        chillbuff_push_back(stringbuilder, claim->value, claim->value_length ? claim->value_length : strlen(claim->value));
+        chillbuff_clear(&escape_buffer);
+        l8w8jwt_escape_claim_string(&escape_buffer, claim->value, value_length);
+
+        chillbuff_push_back(stringbuilder, escape_buffer.array,escape_buffer.length);
 
         if (claim->type == L8W8JWT_CLAIM_TYPE_STRING)
             chillbuff_push_back(stringbuilder, "\"", 1);
 
         first = 0;
     }
 
+    chillbuff_free(&escape_buffer);
     return L8W8JWT_SUCCESS;
 }