/src/test/java/com/alibaba/json/bvt/serializer/SerializeWriterTest_BrowserSecure_5_script_model.java

https://github.com/alibaba/fastjson · Java · 89 lines · 69 code · 15 blank · 5 comment · 2 complexity · a16974979528965709b8ddc667496349 MD5 · raw file

  1. package com.alibaba.json.bvt.serializer;
  2. import com.alibaba.fastjson.JSON;
  3. import com.alibaba.fastjson.JSONObject;
  4. import com.alibaba.fastjson.JSONWriter;
  5. import com.alibaba.fastjson.serializer.SerializerFeature;
  6. import junit.framework.TestCase;
  7. import java.io.StringWriter;
  8. public class SerializeWriterTest_BrowserSecure_5_script_model extends TestCase {
  9. public void test_0() throws Exception {
  10. Model object = new Model();
  11. object.value = "<script>alert(1);</script>";
  12. String text = JSON.toJSONString(object, SerializerFeature.BrowserSecure);
  13. // assertEquals("{\"value\":\"&lt;script&gt;alert(1);&lt;\\/script&gt;\"}", text);
  14. assertEquals("{\"value\":\"\\u003Cscript\\u003Ealert\\u00281\\u0029;\\u003C/script\\u003E\"}", text);
  15. Model object1 = JSON.parseObject(text, Model.class);
  16. assertEquals(object.value, object1.value);
  17. }
  18. public void test_1() throws Exception {
  19. Model object = new Model();
  20. object.value = "<";
  21. String text = JSON.toJSONString(object, SerializerFeature.BrowserSecure);
  22. // assertEquals("{\"value\":\"&lt;script&gt;alert(1);&lt;\\/script&gt;\"}", text);
  23. assertEquals("{\"value\":\"\\u003C\"}", text);
  24. Model object1 = JSON.parseObject(text, Model.class);
  25. assertEquals(object.value, object1.value);
  26. }
  27. public void test_2() throws Exception {
  28. Model object = new Model();
  29. object.value = "<script>";
  30. String text = JSON.toJSONString(object, SerializerFeature.BrowserSecure);
  31. // assertEquals("{\"value\":\"&lt;script&gt;alert(1);&lt;\\/script&gt;\"}", text);
  32. assertEquals("{\"value\":\"\\u003Cscript\\u003E\"}", text);
  33. Model object1 = JSON.parseObject(text, Model.class);
  34. assertEquals(object.value, object1.value);
  35. }
  36. //
  37. public void test_3() throws Exception {
  38. StringBuilder buf = new StringBuilder();
  39. for (int i = 0; i < 500; i++) {
  40. buf.append("<script>");
  41. }
  42. StringBuilder buf1 = new StringBuilder();
  43. buf1.append("{\"value\":\"");
  44. for (int i = 0; i < 500; i++) {
  45. buf1.append("\\u003Cscript\\u003E");
  46. }
  47. buf1.append("\"}");
  48. Model object = new Model();
  49. object.value = buf.toString();
  50. StringWriter out = new StringWriter();
  51. JSONWriter writer = new JSONWriter(out);
  52. writer.config(SerializerFeature.BrowserSecure, true);
  53. writer.writeObject(object);
  54. writer.flush();
  55. assertEquals(buf1.toString(), out.toString());
  56. }
  57. //
  58. public void test_4() throws Exception {
  59. String text = JSON.toJSONString(new Model("("), SerializerFeature.BrowserSecure);
  60. assertEquals("{\"value\":\"\\u0028\"}", text);
  61. }
  62. public void test_5() throws Exception {
  63. String text = JSON.toJSONString(new Model(")"), SerializerFeature.BrowserSecure);
  64. assertEquals("{\"value\":\"\\u0029\"}", text);
  65. }
  66. public static class Model {
  67. public String value;
  68. public Model() {
  69. }
  70. public Model(String value) {
  71. this.value = value;
  72. }
  73. }
  74. }