Skip to content

[Cherry pick] Avoid escaping HTML sensitive chars when writing config to file#1692

Merged
Aniruddh25 merged 5 commits intorelease/0.8from
cherryPickEncodedSerialization
Sep 7, 2023
Merged

[Cherry pick] Avoid escaping HTML sensitive chars when writing config to file#1692
Aniruddh25 merged 5 commits intorelease/0.8from
cherryPickEncodedSerialization

Conversation

@Aniruddh25
Copy link
Copy Markdown
Collaborator

@Aniruddh25 Aniruddh25 commented Sep 7, 2023

Aniruddh25 and others added 5 commits August 29, 2023 09:38
## Why make this change?

- With the overhaul of the config system using our own Write method
while serializing objects, the config that is generated is misaligned
with respect to indentation for all the keys under each entity name.
For e.g.:
In the following picture, the entity name `Todo` is indented with 4
leading spaces, subsequently its child key `source` should have been
indented with 6 leading spaces, however its currently indented with only
2 spaces.


![image](https://github.com/Azure/data-api-builder/assets/3513779/4c4a926f-ae22-444e-bc86-23f207b3cf22)

- This is a regression in 0.8.44-rc.

## What is this change?

- Use the same writer to serialize the subkeys under the entity name so
that the depth of indentation is maintained.

## How does this change fix the issue?
- `WriteRawValue` writes the json string argument provided as is without
doing any additional formatting on it. It doesn't utilize the
`_currentDepth` private member of the writer to determine how to indent.

- Prior to this change, we were generating the inner json string first
then writing the generated inner json "as is". While generating that
json on line 29


https://github.com/Azure/data-api-builder/blob/31b754251832ffebf4c4ce36ffcbead9baff6355/src/Config/Converters/RuntimeEntitiesConverter.cs#L29

Line 29 in
[31b7542](31b7542)

a new writer is being used by the `JsonSerializer.Serialize()` function,
effectively resetting the `_currentDepth`. The `_currentDepth` of the
writer in context was not getting honored.

## How was this tested?

- Manual test, building solution and using `dab add` to simulate
automatic writing of an entity to the config file. With the change, the
indentation is fixed.


![image](https://github.com/Azure/data-api-builder/assets/3513779/bf708ecc-4fa2-4711-ba88-844c24922b81)
…o file (#1691)

## Why make this change?

- Closes #1687

## What is this change?

- Set the Encoder for JsonSerializationOptions to be
[`JavaScriptEncoder.UnsafeRelaxedJsonEscaping`](https://learn.microsoft.com/en-us/dotnet/api/system.text.encodings.web.javascriptencoder.unsaferelaxedjsonescaping?view=net-7.0)
instead of the default encoder.
- Although [this
article](https://learn.microsoft.com/en-us/dotnet/standard/serialization/system-text-json/character-encoding#serialize-all-characters)
mentions use this encoder with caution, since we are sure the file
contents will be deserialized as UTF-8 JSON, we should be safe to use
this encoder.
- We were using this encoder previously from the fix in #1386, but with
#1402, that original fix was essentially not being used since #1402
introduced usage of the new `GetJsonSerializerOptions()` function in
`RuntimeConfigLoader`.

## How was this tested?

- [X] Unit Tests. `TestSpecialCharactersInConnectionString` is moved to
the `ConfigGeneratorTests` since keeping it as part of `InitTests` with
the Verify framework wasn't really testing the scenario since we ignore
connection strings in the snapshots.
- This regression from #1402 was not caught because this test scenario
was effectively being skipped.
- Note, this test is modified to explicitly compare the expected and
actual json string from file since any usage of
JsonSerializer/JObject.Parse would require using the same encoder to
deserialize making the test itself run similar code which it is testing.
Parsing into JSON objects would treat `\u0027` and `'` as equal whereas
string comparison wont. Hence, comparison using string is necessary to
catch regressions here.

## Sample Request(s)

BEFORE:
`dab init --host-mode development --database-type mssql
--connection-string "@env('my-connection-string')"`

creates the configuration file as follows:

```
{
  "$schema": "https://github.com/Azure/data-api-builder/releases/download/v0.8.49/dab.draft.schema.json",
  "data-source": {
    "database-type": "mssql",
    "connection-string": "@env(\u0027my-connection-string\u0027)",
    "options": {
      "set-session-context": false
    }
  }
```
Note, the value of connection string.

AFTER: Same command creates the following file:
```
{
  "$schema": "https://github.com/Azure/data-api-builder/releases/download/v0.8.49/dab.draft.schema.json",
  "data-source": {
    "database-type": "mssql",
    "connection-string": "@env('my-connection-string')",
    "options": {
      "set-session-context": false
    }
  }
```

---------

Co-authored-by: Abhishek Kumar <[email protected]>
@Aniruddh25 Aniruddh25 changed the base branch from main to release/0.8 September 7, 2023 06:18
@Aniruddh25 Aniruddh25 enabled auto-merge (squash) September 7, 2023 06:18
@Aniruddh25 Aniruddh25 changed the title Cherry pick encoded serialization [Cherry pick] Avoid escaping HTML sensitive chars when writing config to file Sep 7, 2023
Comment thread src/Cli.Tests/ConfigGeneratorTests.cs
Comment thread src/Cli.Tests/ConfigGeneratorTests.cs
Copy link
Copy Markdown
Contributor

@aaronburtle aaronburtle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, couple suggestions but nothing major.

@Aniruddh25 Aniruddh25 merged commit aa103b4 into release/0.8 Sep 7, 2023
@Aniruddh25 Aniruddh25 deleted the cherryPickEncodedSerialization branch September 7, 2023 19:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants