#2517 query json escape u+0000 - u+001f

koekeishiya · Mar 1, 2025 · 53c32db · 53c32db
1 parent 2d4f92e
commit 53c32db
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 8 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,8 @@ All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Changed
+- Properly escape control characters U+0000 - U+001f in queries [#2517](https://github.com/koekeishiya/yabai/issues/2517)
 
 ## [7.1.10] - 2025-02-14
 ### Changed

diff --git a/src/misc/helpers.h b/src/misc/helpers.h
@@ -262,14 +262,21 @@ static inline char *ts_string_escape(char *s)
     int num_replacements = 0;
 
     while (*cursor) {
-        if ((*cursor == '"') ||
-            (*cursor == '\\') ||
-            (*cursor == '\b') ||
-            (*cursor == '\f') ||
-            (*cursor == '\n') ||
-            (*cursor == '\r') ||
-            (*cursor == '\t')) {
+        switch (*cursor) {
+        case '"':
+        case '\\':
+        case '\b':
+        case '\f':
+        case '\n':
+        case '\r':
+        case '\t':
             ++num_replacements;
+            break;
+        default:
+            if (*cursor >= 0x00 && *cursor <= 0x1f) {
+                num_replacements += 5;
+            }
+            break;
         }
 
         ++cursor;
@@ -284,7 +291,7 @@ static inline char *ts_string_escape(char *s)
     for (char *dst = result, *cursor = s; *cursor; ++cursor) {
         if (*cursor == '"') {
             *dst++ = '\\';
-            *dst++ = *cursor;
+            *dst++ = '"';
         } else if (*cursor == '\\') {
             *dst++ = '\\';
             *dst++ = '\\';
@@ -303,6 +310,11 @@ static inline char *ts_string_escape(char *s)
         } else if (*cursor == '\t') {
             *dst++ = '\\';
             *dst++ = 't';
+        } else if (*cursor >= 0x00 && *cursor <= 0x1f) {
+            *dst++ = '\\';
+            *dst++ = 'u';
+            sprintf(dst, "%04x", (int)*cursor);
+            dst += 4;
         } else {
             *dst++ = *cursor;
         }