search

wandenberg / nginx-push-stream-module

A pure stream http push technology for your Nginx setup. Comet made easy and really scalable.
Other
2.22k stars 295 forks source link

Quote and anti-slash in channel name breaks JSON stats #186

Closed geekuillaume closed 9 years ago

geekuillaume commented 9 years ago

When a channel containing a double quote in its name is created, Push-Stream doesn't escape it so the channels stats JSON is invalid (or can be modified by inserting anything in it). The simple fix would be to a an anti-slash before each double quote and each anti-slash.

Example with a channel named: TestRoom",","

{"hostname": "geekuillaumelaptop", "time": "2015-06-12T08:47:49", "channels": "1", "wildcard_channels": "0", "uptime": "1032", "infos": [
{"channel": "TestRoom",","", "published_messages": "0", "stored_messages": "0", "subscribers": "1"}
]}

Expected result:

{"hostname": "geekuillaumelaptop", "time": "2015-06-12T08:47:49", "channels": "1", "wildcard_channels": "0", "uptime": "1032", "infos": [
{"channel": "TestRoom\",\",\"", "published_messages": "0", "stored_messages": "0", "subscribers": "1"}
]}

With anti-slashes in the name, the behaviour is really strange, example with a channel named: TestRoom",\","\

{"hostname": "geekuillaumelaptop", "time": "2015-06-12T08:49:37", "channels": "2", "wildcard_channels": "0", "uptime": "1140", "infos": [
{"channel": "TestRoom",", "published_messages": "0", "stored_messages": "0", "subscribers": "1"},
{"channel": "","", "published_messages": "0", "stored_messages": "0", "subscribers": "1"}
]}

Expected result:

{"hostname": "geekuillaumelaptop", "time": "2015-06-12T08:49:37", "channels": "2", "wildcard_channels": "0", "uptime": "1140", "infos": [
{"channel": "TestRoom\",\\\",\"\\", "published_messages": "0", "stored_messages": "0", "subscribers": "1"}
]}
wandenberg commented 9 years ago

You will have the same problem if your message template is a JSON and you let channels with quotes being created. The application using the push stream module should be responsible to let or not use some chars on channels names or message text. You also can use one of the others statistics formats: xml, yml, plain text, just set the Accept header to the proper value.