Escape JSON request bodies to handle special characters safely

Author: laurentpellegrino

src/main/java/co/ipregistry/api/client/request/DefaultRequestHandler.java

@@ -25,6 +25,7 @@
 import co.ipregistry.api.client.model.UserAgentList;
 import co.ipregistry.api.client.model.error.LookupError;
 import co.ipregistry.api.client.options.IpregistryOption;
+import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.DeserializationFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.hc.client5.http.config.RequestConfig;
@@ -40,11 +41,10 @@
 import java.io.IOException;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Iterator;
+import java.util.List;
 import java.util.concurrent.TimeUnit;
-import java.util.stream.Collectors;
-import java.util.stream.StreamSupport;
 
 
 /**
@@ -207,20 +207,9 @@ public IpInfoList lookup(final Iterable<String> ips, final IpregistryOption... o
 
     @Override
     public UserAgentList parse(final String... userAgents) throws ApiException, ClientException {
-        final StringBuilder buffer = new StringBuilder();
-        final Iterator<String> iterator = Arrays.stream(userAgents).iterator();
-        while (iterator.hasNext()) {
-            buffer.append('"');
-            buffer.append(iterator.next());
-            buffer.append('"');
-            if (iterator.hasNext()) {
-                buffer.append(',');
-            }
-        }
-
         try {
             final Object result = Request.post(config.getBaseUrl() + "/user_agent")
-                    .bodyString("[" + buffer + "]", ContentType.APPLICATION_JSON)
+                    .bodyString(toJsonList(Arrays.asList(userAgents)), ContentType.APPLICATION_JSON)
                     .addHeader("authorization", "ApiKey " + config.getApiKey())
                     .connectTimeout(Timeout.ofMilliseconds(config.getConnectionTimeout()))
                     .responseTimeout(Timeout.ofMilliseconds(config.getSocketTimeout()))
@@ -246,11 +235,19 @@ public UserAgentList parse(final String... userAgents) throws ApiException, Clie
         }
     }
 
-    private String toJsonList(final Iterable<String> ips) {
-        return '[' + StreamSupport
-                .stream(ips.spliterator(), false)
-                .map(ip -> "\"" + ip + "\"")
-                .collect(Collectors.joining(",")) + ']';
+    /**
+     * Serializes the specified {@code values} into a JSON array, escaping each value so that
+     * characters such as double quotes, backslashes, and control characters produce a valid
+     * JSON body rather than a malformed or injectable one.
+     *
+     * @param values the values to serialize.
+     * @return a JSON array representation of the specified {@code values}.
+     * @throws JsonProcessingException if the values cannot be serialized.
+     */
+    String toJsonList(final Iterable<String> values) throws JsonProcessingException {
+        final List<String> list = new ArrayList<>();
+        values.forEach(list::add);
+        return objectMapper.writeValueAsString(list);
     }
 
     @Override

src/test/java/co/ipregistry/api/client/request/DefaultRequestHandlerTest.java

@@ -18,9 +18,12 @@
 
 import co.ipregistry.api.client.IpregistryConfig;
 import co.ipregistry.api.client.options.IpregistryOption;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 
+import java.util.Arrays;
+
 class DefaultRequestHandlerTest {
 
     @Test
@@ -35,4 +38,26 @@ void testBuildApiUrl_optionsEncoded() {
         Assertions.assertEquals(config.getBaseUrl() + "/8.8.8.8?test=%5Btest%5D", url);
     }
 
+    @Test
+    void testToJsonListEscapesSpecialCharacters() throws Exception {
+        final IpregistryConfig config =
+                IpregistryConfig.builder().apiKey("test").build();
+        final DefaultRequestHandler requestHandler =
+                new DefaultRequestHandler(config);
+
+        final String[] values = {
+                "Mozilla/5.0 \"quoted\"",
+                "back\\slash",
+                "line\nbreak",
+                "comma,and]bracket"
+        };
+
+        final String json = requestHandler.toJsonList(Arrays.asList(values));
+
+        // The produced body must be valid JSON that round-trips to the exact input values.
+        // The previous string-concatenation implementation produced malformed JSON for these inputs.
+        final String[] parsed = new ObjectMapper().readValue(json, String[].class);
+        Assertions.assertArrayEquals(values, parsed);
+    }
+
 }