[SOLR-2520] JSONResponseWriter w/json.wrf can produce invalid javascript depending on unicode chars in response data

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.0-ALPHA
• Fix Version/s: 3.2
• Assignee: Unassigned
• Reporter: Benson Margulies
• Created: 16/May/11 00:05
• Updated: 03/Jun/11 16:44
• Resolved: 17/May/11 02:14

Description

Please see http://timelessrepo.com/json-isnt-a-javascript-subset.

If a stored field contains Unicode characters that are valid in Json but not valid in Javascript, and you use the query option to ask for JSONP (json.wrf), solr does not escape them, resulting in content that explodes on contact with browsers. That is, there are certain Unicode characters that are valid JSON but invalid in Javascript source, and a JSONP response is javascript source, to be incorporated in an HTML script tag. Further investigation suggests that only one character is a problem here: U+2029 must be represented as \u2029 instead of left 'as-is'.