[PR #1512] do not escape JSON response #1625

New issue

Open

opened 2026-05-07 01:02:58 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-07 01:02:58 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/binwiederhier/ntfy/pull/1512
Author: @wunter8
Created: 12/7/2025
Status: 🔄 Open

Base: main ← Head: 1511-ampersand

📝 Commits (1)

fb89b87 do not escape JSON response

📊 Changes

2 files changed (+12 additions, -4 deletions)

View changed files

📝 server/server.go (+9 -3)
📝 server/server_matrix.go (+3 -1)

📄 Description

Apparently, golang's JSON encoder automatically escapes <, &, and > in a JSON response (See https://github.com/golang/go/issues/28453 and https://pkg.go.dev/encoding/json#Encoder.SetEscapeHTML).

This was unexpected to me. It seems like whoever is using the returned ntfy message should choose to escape the data if they want to before they use it, instead of ntfy always escaping the data.

Before the change, curl -d '&' https://ntfy.sh/test would return {..."message":"\u0026"...}

After the change, curl -d '&' https://ntfy.sh/test returns {..."message":"&"...}

Fixes #1511

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/binwiederhier/ntfy/pull/1512 **Author:** [@wunter8](https://github.com/wunter8) **Created:** 12/7/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `1511-ampersand` --- ### 📝 Commits (1) - [`fb89b87`](https://github.com/binwiederhier/ntfy/commit/fb89b87efbd8769db97f66fc45c9f88e878ed5af) do not escape JSON response ### 📊 Changes **2 files changed** (+12 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `server/server.go` (+9 -3) 📝 `server/server_matrix.go` (+3 -1) </details> ### 📄 Description Apparently, golang's JSON encoder automatically escapes `<`, `&`, and `>` in a JSON response (See https://github.com/golang/go/issues/28453 and https://pkg.go.dev/encoding/json#Encoder.SetEscapeHTML). This was unexpected to me. It seems like whoever is using the returned ntfy message should choose to escape the data if they want to before they use it, instead of ntfy always escaping the data. Before the change, `curl -d '&' https://ntfy.sh/test` would return `{..."message":"\u0026"...}` After the change, `curl -d '&' https://ntfy.sh/test` returns `{..."message":"&"...}` Fixes #1511 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>