转到json中的scape html html请求

Question

I want to scape to html some json in request but it doesn´t work, I get an error when decoding json

import (
    "html/template" 
    "encoding/json"
    "net/http"
    "io"
    "io/ioutil"
    "log"
)

func anyFunction(w http.ResponseWriter, r *http.Request) {
    body, err := ioutil.ReadAll(r.Body)
    if err != nil {
        log.Print(err)
    }
    ri, wo := io.Pipe()
    go template.HTMLEscape(wo, body)   
    var t []customStruct
    json.NewDecoder(ri).Decode(t) //error: Invalid character:'&' looking for beginning of object key string
    ...
}

The json coming from the client it´s valid because I´m using "JSON.stringify(data)" Go 1.9.4

Answer 1

Do not html-escape the whole valid json payload, you are inadvertently invalidating it which causes the json decoding to fail.

If you need to sanitize values contained in the valid json, you can do so either after you first unmarshal it, or during the unmarshaling by implementing the json.Unmarshaler interface on a custom type which could then sanitize the raw bytes of the value.