diff --git a/apps/master/RestServer.cpp b/apps/master/RestServer.cpp index 4d3ebc0c8..078fc3b98 100644 --- a/apps/master/RestServer.cpp +++ b/apps/master/RestServer.cpp @@ -30,12 +30,33 @@ inline void ptreeToServer(boost::property_tree::ptree &pt, MasterServer::SServer server.SetMaxPlayers(pt.get("max_players")); } +inline std::string escapeString(const std::string &str) +{ + const std::string escapeChars = "\"\\/\b\f\n\r\t"; + const std::string escapeSequences = "\"\\/\b\f\n\r\t"; + + std::stringstream ss; + for (char c : str) + { + size_t found = escapeChars.find(c); + if (found != std::string::npos) + { + ss << '\\' << escapeSequences[found]; + } + else + { + ss << c; + } + } + return ss.str(); +} + inline void queryToStringStream(stringstream &ss, string addr, MasterServer::SServer &query) { - ss <<"\"" << addr << "\":{"; - ss << "\"modname\": \"" << query.GetGameMode() << "\"" << ", "; + ss << "\"" << addr << "\":{"; + ss << "\"modname\": \"" << escapeString(query.GetGameMode()) << "\", "; ss << "\"passw\": " << (query.GetPassword() ? "true" : "false") << ", "; - ss << "\"hostname\": \"" << query.GetName() << "\"" << ", "; + ss << "\"hostname\": \"" << escapeString(query.GetName()) << "\", "; ss << "\"query_port\": " << 0 << ", "; ss << "\"last_update\": " << duration_cast(steady_clock::now() - query.lastUpdate).count() << ", "; ss << "\"players\": " << query.GetPlayers() << ", ";