dmitry-kulikov / yii2-json-editor Goto Github PK

What steps will reproduce the problem?

$model->data = '"foo"';
echo $form->field($model, 'data', ['inputOptions' => ['value' => '"bar"']])
    ->widget(JsonEditor::class);

What is the expected result?

Widget should show:

"bar"

What do you get instead?

Widget shows:

"foo"

Additional info

What steps will reproduce the problem?

$model->data = null;
echo $form->field(
    $model,
    'data',
    ['inputOptions' => ['id' => 'json-editor-hidden-input']]
)
    ->widget(
        JsonEditor::class,
        [
            'defaultValue' => '{"foo": "bar"}',
        ]
    );

In browser console execute:

$('#json-editor-hidden-input').val();

What is the expected result?

In browser console should be:

"{\"foo\": \"bar\"}"

What do you get instead?

In browser console:

""

Additional info

Normally such JS should not be used to access JSON editor, this code just shows problem.
Correct way to access JSON editor is:

var jsonEditor = window[$('#json-editor-hidden-input').data('json-editor-name')];
jsonEditor.get();

It works properly:

Object { foo: "bar" }

What steps will reproduce the problem?

use kdn\yii2\JsonEditor;

$form = ActiveForm::begin();
echo $form->field($model, '[1]data[1]')->widget(JsonEditor::className());
ActiveForm::end();

What is the expected result?

Widget displays JSON.

What do you get instead?

Exception thrown:

2017-09-28 04:07:48 [127.0.0.1][4][4api8mtn0639foed1qttpb48l0][error][yii\base\UnknownPropertyException] exception 'yii\base\UnknownPropertyException' with message 'Setting unknown property: common\models\Test::[1]data[1]' in /path/to/vendor/yiisoft/yii2/base/Component.php:201

Additional info

What steps will reproduce the problem?

$default = '{"foo": "bar"}';
echo JsonEditor::widget(['name' => 'test-1', 'value' => '0', 'defaultValue' => $default]);
echo JsonEditor::widget(['name' => 'test-2', 'value' => 'null', 'defaultValue' => $default]);
echo JsonEditor::widget(['name' => 'test-3', 'value' => '""', 'defaultValue' => $default]);
echo JsonEditor::widget(['name' => 'test-4', 'value' => '', 'defaultValue' => $default]);

What is the expected result?

Widgets should show:

0

null

""

{
  "foo": "bar"
}

What do you get instead?

Widgets show:

{
  "foo": "bar"
}

{}

{}

{
  "foo": "bar"
}

Additional info

What steps will reproduce the problem?

composer install

What is the expected result?

should install dependencies

What do you get instead?

Your requirements could not be resolved to an installable set of packages.

Problem 1
- Installation request for kdn/yii2-json-editor 1.0.2 -> satisfiable by kdn/yii2-json-editor[1.0.2].
- kdn/yii2-json-editor 1.0.2 requires npm-asset/jsoneditor 5.* -> no matching package found.

Additional info

What steps will reproduce the problem?

• Load data from DB via ActiveRecord Model. One of the fields has JSON type, so starting from 2.0.14 it is converted to Array while populating
• Use Active form and use the widget, for example:

<?= $form->field($model, 'test'
        ->widget(JsonEditor::class, [
            'clientOptions' => ['modes' => ['code', 'tree']],
        ]);
    ?>

$model->test will contains array, which is a default behavior when retrieved JSON data type from db, yii do something like
$placeholder = $this->queryBuilder->bindParam(Json::encode($value), $params);

What is the expected result?

widget can read data array from JSON data type

What do you get instead?

Error: Invalid JSON data.

Additional info

Please check at JsonEditor.php
Line: 170
$encodedValue = Json::htmlEncode(Json::decode($this->value, false));

Maybe we can add a value checking first before decode the value:
$encodedValue => is_array($this->value) ? Json::htmlEncode($this->value) : Json::htmlEncode(Json::decode($this->value, false));

What steps will reproduce the problem?

$model->data = '"foo"';
echo $form->field($model, 'data', ['inputOptions' => ['value' => '"bar"']])
    ->widget(JsonEditor::class, ['value' => '"test"']);

What is the expected result?

Widget should show:

"test"

What do you get instead?

Widget shows:

"foo"

Additional info

What steps will reproduce the problem?

use kdn\yii2\JsonEditor;

echo JsonEditor::widget(
    [
        'name' => 'editor',
        'value' => '{"script": "<script type=\"text/javascript\">alert(\"XSS\");</script>"}',
    ]
);

What is the expected result?

Widget displays JSON.

What do you get instead?

Widget not shown. Error in browser console:

SyntaxError: unterminated string literal

Additional info

Looks like <script> tag is not properly escaped. This bug may produce risk of XSS vulnerability.