shinypb / openkeyval

OpenKeyval.org is a completely open key-value data store, exposed as a drop-dead simple web service. The goal is to make this a very easy way to persist data in web applications.
http://openkeyval.org
Other
136 stars 35 forks source link

Escaping ' " \ #4

Closed kevinastock closed 13 years ago

kevinastock commented 13 years ago

Some characters are being escaped which are consistent with php magic quotes being on.

$ cat test.txt 
' " \
abc123!@#$%^&*()_+=-`~;:/?><,.{}[]|

$ curl -F "data=<test.txt;type=text/plain" http://api.openkeyval.org/hello
{"status":"set","key":"hello","read_only_key":"rok-088ec226a37329f3980db9ab5082c

$ curl http://api.openkeyval.org/hello
\' \" \\
abc123!@#$%^&*()_+=-`~;:/?><,.{}[]|
tecywiz121 commented 13 years ago

Seconded. Also, it is escaping the nul character.

tomash commented 13 years ago

thirded, as described here: http://www.reddit.com/r/programming/comments/dy2rh/hey_reddit_we_just_made_openkeyvalorg_an_open/c13t9h8

FlyingV currently has a facility for hacking around that when getting data serialized to JSON (i.e. prior to deserializing, otherwise json parsing fails), but I'd love to remove this hack: http://github.com/tomash/flyingv/blob/master/lib/flyingv.rb#L7

kevinastock commented 13 years ago

From what I can tell looking at the source the data is not serialized to JSON. There are only two calls to json_encode, which are only called if there's a callback or no body (data) text.

Edit: My bad, I misunderstood what flyingv was doing.

tomash commented 13 years ago

nonono, misunderstanding. json (de)serializing is done of course only in my ruby library (flyingv).

dustball commented 13 years ago

Fixed with 2a08e67ec15aba015753873978c1e57354c16904

tomash commented 13 years ago

Great, thanks! I've removed the dirty hack from FlyingV then: http://github.com/tomash/flyingv/commit/c8963024375cb00e9459c588586da4383805626b and bumbed gem version.