libs/web: fix luci.http.write_json() to properly encode control chars in strings

1 files changed, 4 insertions, 5 deletions

diff --git a/libs/web/luasrc/http.lua b/libs/web/luasrc/http.lua
index 18112507c..c53307a5a 100644
--- a/libs/web/luasrc/http.lua
+++ b/libs/web/luasrc/http.lua
@@ -4,9 +4,6 @@ LuCI - HTTP-Interaction
 Description:
 HTTP-Header manipulator and form variable preprocessor
 
-FileId:
-$Id$
-
 License:
 Copyright 2008 Steven Barth <steven@midlink.org>
 
@@ -334,12 +331,14 @@ function write_json(x)
 		end
 	elseif type(x) == "number" or type(x) == "boolean" then
 		if (x ~= x) then
-			-- NaN is the only value that doesn't equal to itself.   
+			-- NaN is the only value that doesn't equal to itself.
 			write("Number.NaN")
 		else
 			write(tostring(x))
 		end
 	else
-		write("%q" % tostring(x))
+		write('"%s"' % tostring(x):gsub('["%z\1-\31]', function(c)
+			return '\\u%04x' % c:byte(1)
+		end))
 	end
 end