mjhjmtu

I have to send a POST request to some service with json payload, and it includes some user input. That input variable needs to be Json-encoded to prevent injection attacks.

Code example that sends requests and parses response json to RESP variable:

RESP=`curl --connect-timeout "10" -s -H "Content-Type: application/json" 
 -X POST -d ' "Attribute": '"'$USERINPUT'" ',
 $ENDPOINT | $JQ -r '.key'`

how to sanitize, or json encode $USERINPUT before creating json payload?

Using jq:

USERINPUT=$'a e""R<*&4nthello!''

This string has a couple of double quotes, an EOT character, a newline, a tab and a single quote, along with some ordinary text.

data="$( jq --null-input --compact-output --arg str "$USERINPUT" '"Attribute": $str' )"

This builds a JSON object containing the user data as the value for the lone Attribute field.

The same thing using short options:

data="$( jq -nc --arg str "$USERINPUT" '"Attribute": $str' )"

From this we get

"Attribute":"ae""R<*&u0004nthello!'"

as the value in $data.

This can now be used in your call to curl:

RESP="$( curl --connect-timeout "10" -s 
 -H "Content-Type: application/json" 
 -X POST -d "$data" 
 "$ENDPOINT" | jq -r '.key' )"

You can use the Python module json.tool from the command line to parse JSON:

export USERINPUT="[1,2,3]"
echo $USERINPUT| python -mjson.tool
[
 1,
 2,
 3
]