Joerg Hoh created SLING-13378:
---------------------------------
Summary: JmxServlet produces invalid or altered JSON for valid
MBean names containing quotes or backslashes
Key: SLING-13378
URL: https://issues.apache.org/jira/browse/SLING-13378
Project: Sling
Issue Type: Bug
Components: Starter
Reporter: Joerg Hoh
The {{/bin/jmx.json}} endpoint in {{org.apache.sling.starter.test-services}}
manually wraps each MBean {{ObjectName}} in double quotes without JSON escaping.
Valid JMX object names can contain quotes and backslashes. Consequently:
* Quoted property values can produce invalid JSON, causing parsing errors.
* Unquoted backslashes can be interpreted as JSON escape sequences, silently
changing the decoded name. For example, {{name=backslash\name}} decodes with a
newline instead of the literal {{\n}}.
The affected names can be successfully registered and their attributes accessed
through the platform MBeanServer. This is a servlet serialization defect, not
an invalid MBean registration.
h3. Expected behavior
The endpoint returns a valid JSON array whose strings exactly match the
registered {{ObjectName.toString()}} values.
h3. Proposed fix
Replace manual JSON construction with {{jakarta.json.JsonArrayBuilder}} and
{{JsonWriter}}.
Add regression unit tests covering:
* Plain names.
* Quoted property values containing quotes and backslashes.
* Unquoted property values containing backslashes.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
