[
https://issues.apache.org/jira/browse/SLING-13378?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh resolved SLING-13378.
-------------------------------
Fix Version/s: Starter Test Services 15
Resolution: Fixed
> JmxServlet produces invalid or altered JSON for valid MBean names containing
> quotes or backslashes
> --------------------------------------------------------------------------------------------------
>
> Key: SLING-13378
> URL: https://issues.apache.org/jira/browse/SLING-13378
> Project: Sling
> Issue Type: Bug
> Components: Starter
> Reporter: Joerg Hoh
> Assignee: Joerg Hoh
> Priority: Major
> Fix For: Starter Test Services 15
>
>
> The {{/bin/jmx.json}} endpoint in {{org.apache.sling.starter.test-services}}
> manually wraps each MBean {{ObjectName}} in double quotes without JSON
> escaping.
> Valid JMX object names can contain quotes and backslashes. Consequently:
> * Quoted property values can produce invalid JSON, causing parsing errors.
> * Unquoted backslashes can be interpreted as JSON escape sequences, silently
> changing the decoded name. For example, {{name=backslash\name}} decodes with
> a newline instead of the literal {{\n}}.
> The affected names can be successfully registered and their attributes
> accessed through the platform MBeanServer. This is a servlet serialization
> defect, not an invalid MBean registration.
> h3. Expected behavior
> The endpoint returns a valid JSON array whose strings exactly match the
> registered {{ObjectName.toString()}} values.
> h3. Proposed fix
> Replace manual JSON construction with {{jakarta.json.JsonArrayBuilder}} and
> {{JsonWriter}}.
> Add regression unit tests covering:
> * Plain names.
> * Quoted property values containing quotes and backslashes.
> * Unquoted property values containing backslashes.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
