3 * Wrapper for json_encode and json_decode.
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 * http://www.gnu.org/copyleft/gpl.html
24 * JSON formatter wrapper class
28 * Skip escaping most characters above U+007F for readability and compactness.
29 * This encoding option saves 3 to 8 bytes (uncompressed) for each such character;
30 * however, it could break compatibility with systems that incorrectly handle UTF-8.
37 * Skip escaping the characters '<', '>', and '&', which have special meanings in
40 * @warning Do not use this option for JSON that could end up in inline scripts.
41 * - HTML5, §4.3.1.2 Restrictions for contents of script elements
42 * - XML 1.0 (5th Ed.), §2.4 Character Data and Markup
49 * Skip escaping as many characters as reasonably possible.
51 * @warning When generating inline script blocks, use FormatJson::UTF8_OK instead.
58 * Regex that matches whitespace inside empty arrays and objects.
60 * This doesn't affect regular strings inside the JSON because those can't
61 * have a real line break (\n) in them, at this point they are already escaped
62 * as the string "\n" which this doesn't match.
66 const WS_CLEANUP_REGEX
= '/(?<=[\[{])\n\s*+(?=[\]}])/';
69 * Characters problematic in JavaScript.
71 * @note These are listed in ECMA-262 (5.1 Ed.), §7.3 Line Terminators along with U+000A (LF)
72 * and U+000D (CR). However, PHP already escapes LF and CR according to RFC 4627.
74 private static $badChars = array(
75 "\xe2\x80\xa8", // U+2028 LINE SEPARATOR
76 "\xe2\x80\xa9", // U+2029 PARAGRAPH SEPARATOR
80 * Escape sequences for characters listed in FormatJson::$badChars.
82 private static $badCharsEscaped = array(
83 '\u2028', // U+2028 LINE SEPARATOR
84 '\u2029', // U+2029 PARAGRAPH SEPARATOR
88 * Returns the JSON representation of a value.
90 * @note Empty arrays are encoded as numeric arrays, not as objects, so cast any associative
91 * array that might be empty to an object before encoding it.
93 * @note In pre-1.22 versions of MediaWiki, using this function for generating inline script
94 * blocks may result in an XSS vulnerability, and quite likely will in XML documents
95 * (cf. FormatJson::XMLMETA_OK). Use Xml::encodeJsVar() instead in such cases.
97 * @param mixed $value The value to encode. Can be any type except a resource.
98 * @param bool $pretty If true, add non-significant whitespace to improve readability.
99 * @param int $escaping Bitfield consisting of _OK class constants
100 * @return string|bool: String if successful; false upon failure
102 public static function encode( $value, $pretty = false, $escaping = 0 ) {
103 if ( defined( 'JSON_UNESCAPED_UNICODE' ) ) {
104 return self
::encode54( $value, $pretty, $escaping );
107 return self
::encode53( $value, $pretty, $escaping );
111 * Decodes a JSON string.
113 * @param string $value The JSON string being decoded
114 * @param bool $assoc When true, returned objects will be converted into associative arrays.
116 * @return mixed The value encoded in JSON in appropriate PHP type.
117 * `null` is returned if the JSON cannot be decoded or if the encoded data is deeper than
118 * the recursion limit.
120 public static function decode( $value, $assoc = false ) {
121 return json_decode( $value, $assoc );
125 * JSON encoder wrapper for PHP >= 5.4, which supports useful encoding options.
127 * @param mixed $value
128 * @param bool $pretty
129 * @param int $escaping
130 * @return string|bool
132 private static function encode54( $value, $pretty, $escaping ) {
133 // PHP escapes '/' to prevent breaking out of inline script blocks using '</script>',
134 // which is hardly useful when '<' and '>' are escaped (and inadequate), and such
135 // escaping negatively impacts the human readability of URLs and similar strings.
136 $options = JSON_UNESCAPED_SLASHES
;
137 $options |
= $pretty ? JSON_PRETTY_PRINT
: 0;
138 $options |
= ( $escaping & self
::UTF8_OK
) ? JSON_UNESCAPED_UNICODE
: 0;
139 $options |
= ( $escaping & self
::XMLMETA_OK
) ?
0 : ( JSON_HEX_TAG | JSON_HEX_AMP
);
140 $json = json_encode( $value, $options );
141 if ( $json === false ) {
146 // Remove whitespace inside empty arrays/objects; different JSON encoders
147 // vary on this, and we want our output to be consistent across implementations.
148 $json = preg_replace( self
::WS_CLEANUP_REGEX
, '', $json );
150 if ( $escaping & self
::UTF8_OK
) {
151 $json = str_replace( self
::$badChars, self
::$badCharsEscaped, $json );
158 * JSON encoder wrapper for PHP 5.3, which lacks native support for some encoding options.
159 * Therefore, the missing options are implemented here purely in PHP code.
161 * @param mixed $value
162 * @param bool $pretty
163 * @param int $escaping
164 * @return string|bool
166 private static function encode53( $value, $pretty, $escaping ) {
167 $options = ( $escaping & self
::XMLMETA_OK
) ?
0 : ( JSON_HEX_TAG | JSON_HEX_AMP
);
168 $json = json_encode( $value, $options );
169 if ( $json === false ) {
173 // Emulate JSON_UNESCAPED_SLASHES. Because the JSON contains no unescaped slashes
174 // (only escaped slashes), a simple string replacement works fine.
175 $json = str_replace( '\/', '/', $json );
177 if ( $escaping & self
::UTF8_OK
) {
178 // JSON hex escape sequences follow the format \uDDDD, where DDDD is four hex digits
179 // indicating the equivalent UTF-16 code unit's value. To most efficiently unescape
180 // them, we exploit the JSON extension's built-in decoder.
181 // * We escape the input a second time, so any such sequence becomes \\uDDDD.
182 // * To avoid interpreting escape sequences that were in the original input,
183 // each double-escaped backslash (\\\\) is replaced with \\\u005c.
184 // * We strip one of the backslashes from each of the escape sequences to unescape.
185 // * Then the JSON decoder can perform the actual unescaping.
186 $json = str_replace( "\\\\\\\\", "\\\\\\u005c", addcslashes( $json, '\"' ) );
187 $json = json_decode( preg_replace( "/\\\\\\\\u(?!00[0-7])/", "\\\\u", "\"$json\"" ) );
188 $json = str_replace( self
::$badChars, self
::$badCharsEscaped, $json );
192 return self
::prettyPrint( $json );
199 * Adds non-significant whitespace to an existing JSON representation of an object.
200 * Only needed for PHP < 5.4, which lacks the JSON_PRETTY_PRINT option.
202 * @param string $json
205 private static function prettyPrint( $json ) {
208 $json = strtr( $json, array( '\\\\' => '\\\\', '\"' => "\x01" ) );
209 for ( $i = 0, $n = strlen( $json ); $i < $n; $i +
= $skip ) {
211 switch ( $json[$i] ) {
220 $buf .= $json[$i] . "\n" . str_repeat( ' ', $indent );
224 $buf .= "\n" . str_repeat( ' ', --$indent ) . $json[$i];
227 $skip = strcspn( $json, '"', $i +
1 ) +
2;
228 $buf .= substr( $json, $i, $skip );
231 $skip = strcspn( $json, ',]}"', $i +
1 ) +
1;
232 $buf .= substr( $json, $i, $skip );
235 $buf = preg_replace( self
::WS_CLEANUP_REGEX
, '', $buf );
237 return str_replace( "\x01", '\"', $buf );