linux-kernel - Re: [PATCH] tools: bpftool: remove invalid \' json escape

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ceadeae8-2478-0d96-b6be-1b330bbbc2a2@isovalent.com>
Date:   Mon, 27 Feb 2023 15:40:32 +0000
From:   Quentin Monnet <quentin@...valent.com>
To:     Luis Gerhorst <gerhorst@...fau.de>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Martin KaFai Lau <martin.lau@...ux.dev>,
        Song Liu <song@...nel.org>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...nel.org>,
        Stanislav Fomichev <sdf@...gle.com>,
        Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
        bpf@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] tools: bpftool: remove invalid \' json escape

2023-02-27 16:08 UTC+0100 ~ Luis Gerhorst <gerhorst@...fau.de>
> RFC8259 ("The JavaScript Object Notation (JSON) Data Interchange
> Format") only specifies \", \\, \/, \b, \f, \n, \r, and \r as valid
> two-character escape sequences. This does not include \', which is not
> required in JSON because it exclusively uses double quotes as string
> separators.
> 
> Solidus (/) may be escaped, but does not have to. Only reverse
> solidus (\), double quotes ("), and the control characters have to be
> escaped. Therefore, with this fix, bpftool correctly supports all valid
> two-character escape sequences (but still does not support characters
> that require multi-character escape sequences).
> 
> Witout this fix, attempting to load a JSON file generated by bpftool
> using Python 3.10.6's default json.load() may fail with the error
> "Invalid \escape" if the file contains the invalid escaped single
> quote (\').
> 
> Signed-off-by: Luis Gerhorst <gerhorst@...fau.de>

Fixes: b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2
repository")

I see this escape was similarly removed from iproute2's version of the
file [0]. Thanks!

Reviewed-by: Quentin Monnet <quentin@...valent.com>

[0]
https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/lib/json_writer.c?id=49c63bc775d610c3dfd3db0d6501ac29c519967f