security: ensure injected strings are properly escaped

Uses  over  for JSON compatibility.

enclose.go

@@ -2,6 +2,7 @@ package envelope
 
 import (
 	"bytes"
+	"encoding/json"
 	"strconv"
 )
 
@@ -19,13 +20,13 @@ func EncloseEvent(event []byte) Envelope {
 // Format: ["OK", eventID, status, message]
 func EncloseOK(eventID string, status bool, message string) Envelope {
 	var buf bytes.Buffer
-	buf.WriteString(`["OK","`)
-	buf.WriteString(eventID)
-	buf.WriteString(`",`)
+	buf.WriteString(`["OK",`)
+	buf.Write(quote(eventID))
+	buf.WriteString(`,`)
 	buf.WriteString(strconv.FormatBool(status))
-	buf.WriteString(`,"`)
-	buf.WriteString(message)
-	buf.WriteString(`"]`)
+	buf.WriteString(`,`)
+	buf.Write(quote(message))
+	buf.WriteString(`]`)
 	return buf.Bytes()
 }
 
@@ -33,9 +34,8 @@ func EncloseOK(eventID string, status bool, message string) Envelope {
 // Format: ["REQ", subID, filter1, filter2, ...]
 func EncloseReq(subID string, filters [][]byte) Envelope {
 	var buf bytes.Buffer
-	buf.WriteString(`["REQ","`)
-	buf.WriteString(subID)
-	buf.WriteString(`"`)
+	buf.WriteString(`["REQ",`)
+	buf.Write(quote(subID))
 
 	for _, filter := range filters {
 		buf.WriteString(`,`)
@@ -50,9 +50,9 @@ func EncloseReq(subID string, filters [][]byte) Envelope {
 // Format: ["EVENT", subID, event]
 func EncloseSubscriptionEvent(subID string, event []byte) Envelope {
 	var buf bytes.Buffer
-	buf.WriteString(`["EVENT","`)
-	buf.WriteString(subID)
-	buf.WriteString(`",`)
+	buf.WriteString(`["EVENT",`)
+	buf.Write(quote(subID))
+	buf.WriteString(`,`)
 	buf.Write(event)
 	buf.WriteByte(']')
 	return buf.Bytes()
@@ -62,9 +62,9 @@ func EncloseSubscriptionEvent(subID string, event []byte) Envelope {
 // Format: ["EOSE", subID]
 func EncloseEOSE(subID string) Envelope {
 	var buf bytes.Buffer
-	buf.WriteString(`["EOSE","`)
-	buf.WriteString(subID)
-	buf.WriteString(`"]`)
+	buf.WriteString(`["EOSE",`)
+	buf.Write(quote(subID))
+	buf.WriteString(`]`)
 	return buf.Bytes()
 }
 
@@ -72,9 +72,9 @@ func EncloseEOSE(subID string) Envelope {
 // Format: ["CLOSE", subID]
 func EncloseClose(subID string) Envelope {
 	var buf bytes.Buffer
-	buf.WriteString(`["CLOSE","`)
-	buf.WriteString(subID)
-	buf.WriteString(`"]`)
+	buf.WriteString(`["CLOSE",`)
+	buf.Write(quote(subID))
+	buf.WriteString(`]`)
 	return buf.Bytes()
 }
 
@@ -82,11 +82,11 @@ func EncloseClose(subID string) Envelope {
 // Format: ["CLOSED", subID, message]
 func EncloseClosed(subID string, message string) Envelope {
 	var buf bytes.Buffer
-	buf.WriteString(`["CLOSED","`)
-	buf.WriteString(subID)
-	buf.WriteString(`","`)
-	buf.WriteString(message)
-	buf.WriteString(`"]`)
+	buf.WriteString(`["CLOSED",`)
+	buf.Write(quote(subID))
+	buf.WriteString(`,`)
+	buf.Write(quote(message))
+	buf.WriteString(`]`)
 	return buf.Bytes()
 }
 
@@ -94,9 +94,9 @@ func EncloseClosed(subID string, message string) Envelope {
 // Format: ["NOTICE", message]
 func EncloseNotice(message string) Envelope {
 	var buf bytes.Buffer
-	buf.WriteString(`["NOTICE","`)
-	buf.WriteString(message)
-	buf.WriteString(`"]`)
+	buf.WriteString(`["NOTICE",`)
+	buf.Write(quote(message))
+	buf.WriteString(`]`)
 	return buf.Bytes()
 }
 
@@ -104,9 +104,9 @@ func EncloseNotice(message string) Envelope {
 // Format: ["AUTH", challenge]
 func EncloseAuthChallenge(challenge string) Envelope {
 	var buf bytes.Buffer
-	buf.WriteString(`["AUTH","`)
-	buf.WriteString(challenge)
-	buf.WriteString(`"]`)
+	buf.WriteString(`["AUTH",`)
+	buf.Write(quote(challenge))
+	buf.WriteString(`]`)
 	return buf.Bytes()
 }
 
@@ -119,3 +119,8 @@ func EncloseAuthResponse(event []byte) Envelope {
 	buf.WriteByte(']')
 	return buf.Bytes()
 }
+
+func quote(s string) []byte {
+	q, _ := json.Marshal(s)
+	return q
+}