support special characters in context signature

api/osb/context_signature_plugin.go

@@ -82,7 +82,7 @@ func (s *ContextSignaturePlugin) signContext(req *web.Request, next web.Handler)
 		return next.Handle(req)
 	}
 
-	reqBody, err := json.Marshal(reqBodyMap)
+	reqBody, err := marshalJSONNoHTMLEscape(reqBodyMap)
 	if err != nil {
 		log.C(req.Context()).Errorf("failed to marshal request body: %v", err)
 		return next.Handle(req)
@@ -98,7 +98,7 @@ func (cs *ContextSigner) Sign(ctx context.Context, contextMap map[string]interfa
 		log.C(ctx).Errorf(errorMsg)
 		return fmt.Errorf(errorMsg)
 	}
-	ctxByte, err := json.Marshal(contextMap)
+	ctxByte, err := marshalJSONNoHTMLEscape(contextMap)
 	if err != nil {
 		log.C(ctx).Errorf("failed to marshal context: %v", err)
 		return err

api/osb/utils.go

@@ -1,7 +1,9 @@
 package osb
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"github.com/Peripli/service-manager/pkg/client"
 	"github.com/Peripli/service-manager/pkg/log"
@@ -58,3 +60,20 @@ func Get(doRequestWithClient util.DoRequestWithClientFunc, brokerAPIVersion stri
 	return responseBytes, nil
 
 }
+
+func marshalJSONNoHTMLEscape(t interface{}) ([]byte, error) {
+	buffer := &bytes.Buffer{}
+	encoder := json.NewEncoder(buffer)
+	encoder.SetEscapeHTML(false)
+	if err := encoder.Encode(t); err != nil {
+		return nil, err
+	}
+
+	outputBytes := buffer.Bytes()
+	outputLen := len(outputBytes)
+	if outputLen > 0 && rune(outputBytes[outputLen-1]) == '\n' { // remove line break added by encoder.Encode (https://pkg.go.dev/encoding/json#Encoder.Encode)
+		return outputBytes[:outputLen-1], nil
+	}
+
+	return outputBytes, nil
+}

api/osb/utils_test.go

@@ -0,0 +1,57 @@
+package osb
+
+import (
+	"encoding/json"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("OSB Controller Utils test", func() {
+	Describe("marshalJSONNoHTMLEscape", func() {
+		It("keeps special characters", func() {
+			inputMap := map[string]string{"ampersand": "a & b", "smallerThen": "a < b", "biggerThen": "a > b"}
+			expected := []byte(`{"ampersand":"a & b","biggerThen":"a > b","smallerThen":"a < b"}`)
+			notExpected := []byte(`{"ampersand":"a \u0026 b","biggerThen":"a \u003e b","smallerThen":"a \u003c b"}`)
+
+			marshalNoEscapeBytes, err := marshalJSONNoHTMLEscape(inputMap)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(marshalNoEscapeBytes).To(Equal(expected))
+
+			marshalBytes, err := json.Marshal(inputMap)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(marshalBytes).To(Equal(notExpected))
+
+			Expect(marshalNoEscapeBytes).ToNot(Equal(marshalBytes))
+		})
+
+		It("eliminates line break added in the end", func() {
+			inputMap := map[string]string{"prop": "val"}
+			expected := []byte(`{"prop":"val"}`)
+
+			marshalNoEscapeBytes, err := marshalJSONNoHTMLEscape(inputMap)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(marshalNoEscapeBytes).To(Equal(expected))
+
+			marshalBytes, err := json.Marshal(inputMap)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(marshalBytes).To(Equal(expected))
+
+			Expect(marshalNoEscapeBytes).To(Equal(marshalBytes))
+		})
+
+		It("returns empty byte array properly", func() {
+			inputMap := map[string]string{}
+			expected := []byte(`{}`)
+
+			marshalNoEscapeBytes, err := marshalJSONNoHTMLEscape(inputMap)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(marshalNoEscapeBytes).To(Equal(expected))
+
+			marshalBytes, err := json.Marshal(inputMap)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(marshalBytes).To(Equal(expected))
+
+			Expect(marshalNoEscapeBytes).To(Equal(marshalBytes))
+		})
+	})
+})

go.mod

@@ -3,15 +3,13 @@ module github.com/Peripli/service-manager
 go 1.14
 
 require (
-	github.com/AlekSi/gocov-xml v1.0.0 // indirect
 	github.com/DATA-DOG/go-sqlmock v1.3.1-0.20180720083239-852fc940e4b9
 	github.com/InVisionApp/go-health v2.1.0+incompatible
 	github.com/InVisionApp/go-logger v1.0.1
 	github.com/Kount/pq-timeouts v1.0.0
 	github.com/Microsoft/go-winio v0.4.16 // indirect
 	github.com/ajg/form v1.5.1 // indirect
 	github.com/antlr/antlr4 v0.0.0-20210105192202-5c2b686f95e1
-	github.com/axw/gocov v1.1.0 // indirect
 	github.com/benjamintf1/unmarshalledmatchers v1.0.0
 	github.com/cloudfoundry-community/go-cfenv v1.17.1-0.20171115121958-e84b5c116637
 	github.com/containerd/containerd v1.4.3 // indirect
@@ -34,13 +32,12 @@ require (
 	github.com/gorilla/websocket v1.4.2
 	github.com/imkira/go-interpol v1.1.0 // indirect
 	github.com/jmoiron/sqlx v1.2.1-0.20201120164427-00c6e74d816a
-	github.com/jstemmer/go-junit-report v1.0.0 // indirect
 	github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88 // indirect
-	github.com/klauspost/compress v1.11.6 // indirect
 	github.com/konsorten/go-windows-terminal-sequences v1.0.3 // indirect
 	github.com/kubernetes-sigs/go-open-service-broker-client v0.0.0-20180330214919-dca737037ce6
 	github.com/lib/pq v1.9.0
 	github.com/magiconair/properties v1.8.4 // indirect
+	github.com/mattn/go-colorable v0.1.8 // indirect
 	github.com/mitchellh/mapstructure v1.4.0
 	github.com/moby/term v0.0.0-20201216013528-df9cb8a40635 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
@@ -59,26 +56,25 @@ require (
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.3
 	github.com/spf13/viper v1.7.1
-	github.com/t-yuki/gocover-cobertura v0.0.0-20180217150009-aaee18c8195c // indirect
+	github.com/stretchr/testify v1.7.1 // indirect
 	github.com/tidwall/gjson v1.9.3
 	github.com/tidwall/sjson v1.1.4
 	github.com/ulule/limiter v2.2.2+incompatible
-	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/valyala/fasthttp v1.34.0
+	github.com/valyala/fasthttp v1.38.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/yalp/jsonpath v0.0.0-20180802001716-5cc68e5049a0 // indirect
 	github.com/yudai/gojsondiff v0.0.0-20170107030110-7b1b7adf999d // indirect
 	github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82 // indirect
 	github.com/yudai/pp v2.0.1+incompatible // indirect
-	golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad
+	golang.org/x/crypto v0.0.0-20220214200702-86341886e292
 	golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5
 	google.golang.org/appengine v1.6.7 // indirect
 	gopkg.in/DATA-DOG/go-sqlmock.v1 v1.3.0 // indirect
 	gopkg.in/ini.v1 v1.62.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.5.1
+	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
-	gotest.tools/gotestsum v1.8.0 // indirect
 	gotest.tools/v3 v3.0.3 // indirect
 )