fix(upb): escape field key names in jsonenc_fieldval when encoding (#31010)
### Summary
`jsonenc_fieldval` in `upb/json/encode.c` writes an object key with `jsonenc_printf(e, "\"%s\":", name)`, where `name` comes from `upb_FieldDef_JsonName` (or `upb_FieldDef_Name` with `upb_JsonEncode_UseProtoNames`). Field names are checked as identifiers when a descriptor is added to a def pool, but `json_name` is copied from the `FieldDescriptorProto` unchanged. A `json_name` that contains a quote, a backslash or a control character therefore reaches the output unescaped. With the tests added here, a field whose `json_name` is
```
a":1,"b
```
is encoded as `{"a":1,"b":1}`, which is a two-key object, and a `json_name` containing a newline, a backslash or a tab produces invalid JSON. Values, map keys, struct keys and enum names in the same encoder already go through `jsonenc_string` or `jsonenc_stringbody`.
### Fix
In `jsonenc_fieldval`, emit the key with `jsonenc_string`, followed by `:`. The extension branch, which formats the full name in brackets, now passes the name through `jsonenc_stringbody`. Extension full names are identifier-checked by the def builder, so the extension change has no observable effect for descriptors the def pool accepts; it only makes the two branches consistent. It can be dropped if you prefer the smaller change.
This change does not touch `jsonenc_fieldpath`.
### Relationship to #28678
#28678 makes the same `json_name` change in `jsonenc_fieldval`. It also adds a character allow-list to `jsonenc_fieldpath`. Applied to current main, that allow-list makes the existing `EncodeFieldMaskEscapedPaths` fail, because that test expects paths containing a newline, a tab and a quote to encode and be escaped. This change leaves `jsonenc_fieldpath` alone and `EncodeFieldMaskEscapedPaths` keeps passing. If #28678 lands first, the `jsonenc_fieldval` part of this change is redundant.
### Testing
Added to `upb/json/encode_test.cc`, with a new `JsonNameEscape` message in `upb/json/test.proto`:
- `EncodeJsonNamePositiveControl` (also with `upb_JsonEncode_UseProtoNames`)
- `EncodeJsonNameWithQuotesAndBackslashesIsEscaped` (also decodes the output with `upb_JsonDecode` and checks the field round-trips)
- `EncodeJsonNameWithControlCharactersIsEscaped`
```
bazel test //upb/json:encode_test
```
passes with the change (22 tests, including `EncodeFieldMaskEscapedPaths`). Without the change, the two escaping tests fail and the others pass. Built with clang 22.1.8 and Bazel 8.7.0 on x86_64 Linux, also under ASan and UBSan.
AI assistance was used in drafting and validating this change; the patch and tests were reviewed and verified by the author.
Closes #31010
COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/31010 from professor-moody:fix-upb-json-encode-field-key-escaping ff14f061c3b397112c241067e99e1e80aa265c28
PiperOrigin-RevId: 1015144727
Copyright 2008 Google LLC
Protocol Buffers (a.k.a., protobuf) are Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data. You can learn more about it in protobuf's documentation.
This README file contains protobuf installation instructions. To install protobuf, you need to install the protocol compiler (used to compile .proto files) and the protobuf runtime for your chosen programming language.
Most users will find working from supported releases to be the easiest path.
If you choose to work from the head revision of the main branch your build will occasionally be broken by source-incompatible changes and insufficiently-tested (and therefore broken) behavior.
If you are using C++ or otherwise need to build protobuf from source as a part of your project, you should pin to a release commit on a release branch.
This is because even release branches can experience some instability in between release commits.
Protobuf supports Bzlmod with Bazel 8 +. Users should specify a dependency on protobuf in their MODULE.bazel file as follows.
bazel_dep(name = "protobuf", version = <VERSION>)
Users can optionally override the repo name, such as for compatibility with WORKSPACE.
bazel_dep(name = "protobuf", version = <VERSION>, repo_name = "com_google_protobuf")
Users can also add the following to their legacy WORKSPACE file.
Note that with the release of 30.x there are a few more load statements to properly set up rules_java and rules_python.
http_archive(
name = "com_google_protobuf",
strip_prefix = "protobuf-VERSION",
sha256 = ...,
url = ...,
)
load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
protobuf_deps()
load("@rules_java//java:rules_java_deps.bzl", "rules_java_dependencies")
rules_java_dependencies()
load("@rules_java//java:repositories.bzl", "rules_java_toolchains")
rules_java_toolchains()
load("@rules_python//python:repositories.bzl", "py_repositories")
py_repositories()
The protobuf compiler is written in C++. If you are using C++, please follow the C++ Installation Instructions to install protoc along with the C++ runtime.
For non-C++ users, the simplest way to install the protocol compiler is to download a pre-built binary from our GitHub release page.
In the downloads section of each release, you can find pre-built binaries in zip packages: protoc-$VERSION-$PLATFORM.zip. It contains the protoc binary as well as a set of standard .proto files distributed along with protobuf.
If you are looking for an old version that is not available in the release page, check out the Maven repository.
These pre-built binaries are only provided for released versions. If you want to use the github main version at HEAD, or you need to modify protobuf code, or you are using C++, it's recommended to build your own protoc binary from source.
If you would like to build protoc binary from source, see the C++ Installation Instructions.
Protobuf supports several different programming languages. For each programming language, you can find instructions in the corresponding source directory about how to install protobuf runtime for that specific language:
| Language | Source |
|---|---|
| C++ (include C++ runtime and protoc) | src |
| Java | java |
| Python | python |
| Objective-C | objectivec |
| C# | csharp |
| Ruby | ruby |
| Go | protocolbuffers/protobuf-go |
| PHP | php |
| Dart | dart-lang/protobuf |
| JavaScript | protocolbuffers/protobuf-javascript |
The best way to learn how to use protobuf is to follow the tutorials in our developer guide.
If you want to learn from code examples, take a look at the examples in the examples directory.
The complete documentation is available at the Protocol Buffers doc site.
Read about our version support policy to stay current on support timeframes for the language libraries.
To be alerted to upcoming changes in Protocol Buffers and connect with protobuf developers and users, join the Google Group.