python - Why is Flask checking `'\\/' in json.dumps('/')` in its json module? -
the source flask.json
module contains following line. '\\/'
mean, , why flask checking this?
_slash_escape = '\\/' not in _json.dumps('/')
flask using test if json library it's using escapes slashes when doesn't have to. if library does, json.dump('/')
produce '"\\/"'
(equivalent raw string r'"\/"'
, see here explanation on escape characters).
flask can choose 1 of multiple json libraries, , libraries/versions escape forward slashes while others don't. flask includes comment explaining this.
if library escape slashes, flask undo when dumps json, consistency between libraries.
# figure out if simplejson escapes slashes. behavior changed # 1 version without reason. _slash_escape = '\\/' not in _json.dumps('/') ... def htmlsafe_dumps(obj, **kwargs): ... if not _slash_escape: rv = rv.replace('\\/', '/') ...
flask still escapes unsafe html characters when rendering json in html, potentially unsafe string "</script>"
becomes "\\u003c/script\\u003e"
safe.
Comments
Post a Comment