Improve escaping text in handlebars, with a focus on extensibility.

Jellyfin.Plugin.Webhook/Destinations/BaseOption.cs

@@ -12,6 +12,26 @@ namespace Jellyfin.Plugin.Webhook.Destinations;
 /// </summary>
 public abstract class BaseOption
 {
+    /// <summary>
+    /// The data fields that have historically been manually escaped in <see cref="DataObjectHelpers"/>.
+    /// More fields may be added as needed.
+    /// </summary>
+    private static readonly string[] FieldsToEscape =
+    [
+        "ServerName",
+        "Name",
+        "Overview",
+        "Tagline",
+        "ItemType",
+        "SeriesName",
+        "NotificationUsername",
+        "Client",
+        "DeviceName",
+        "PluginName",
+        "PluginChangelog",
+        "ExceptionMessage"
+    ];
+
     private HandlebarsTemplate<object, string>? _compiledTemplate;
 
     /// <summary>
@@ -97,6 +117,11 @@ public abstract class BaseOption
     /// </summary>
     public Guid[] UserFilter { get; set; } = Array.Empty<Guid>();
 
+    /// <summary>
+    /// Gets or sets the Media-Content type of the webhook body. Should not be set by User except for Generic Client.
+    /// </summary>
+    public WebhookMediaContentType MediaContentType { get; set; } = WebhookMediaContentType.Json;
+
     /// <summary>
     /// Gets the compiled handlebars template.
     /// </summary>
@@ -113,10 +138,45 @@ public HandlebarsTemplate<object, string> GetCompiledTemplate()
     /// <returns>The string message body.</returns>
     public string GetMessageBody(Dictionary<string, object> data)
     {
+        Dictionary<string, object> cloneData = new(data); // Quickly clone the dictionary to avoid "over escaping" if we use the same data object for multiple services in a row.
+        foreach (var field in fieldsToEscape)
+        {
+            if (cloneData.TryGetValue(field, out object? value))
+            {
+                cloneData[field] = MediaContentType switch
+                {
+                    WebhookMediaContentType.Json => JsonEncode(value.ToString() ?? string.Empty),
+                    WebhookMediaContentType.PlainText => DefaultEscape(value.ToString() ?? string.Empty),
+                    WebhookMediaContentType.Xml => DefaultEscape(value.ToString() ?? string.Empty),
+                    _ => DefaultEscape(value.ToString() ?? string.Empty)
+                };
+            }
+        }
+
         var body = SendAllProperties
-            ? JsonSerializer.Serialize(data, JsonDefaults.Options)
-            : GetCompiledTemplate()(data);
+            ? JsonSerializer.Serialize(cloneData, JsonDefaults.Options)
+            : GetCompiledTemplate()(cloneData);
 
         return TrimWhitespace ? body.Trim() : body;
     }
+
+    /// <summary>
+    /// Escape a text string using the default Json Encoder.
+    /// </summary>
+    /// <param name="value">A plain-text string that needs escaped.</param>
+    /// <returns>The escaped string.</returns>
+    private static string JsonEncode(string value)
+    {
+        return JsonEncodedText.Encode(value).Value;
+    }
+
+    /// <summary>
+    /// Escapes all backslashes in a string. This is the previous escape method used for all strings.
+    /// </summary>
+    /// <param name="value">A plain-text string that needs escaped.</param>
+    /// <returns>The escaped string.</returns>
+    private static string DefaultEscape(string value)
+    {
+        return value.Replace("\"", "\\\"", StringComparison.Ordinal);
+    }
 }

Jellyfin.Plugin.Webhook/Destinations/Generic/GenericClient.cs

@@ -52,13 +52,6 @@ public async Task SendAsync(GenericOption option, Dictionary<string, object> dat
                 data[field.Key] = field.Value;
             }
 
-            var body = option.GetMessageBody(data);
-            if (!SendMessageBody(_logger, option, body))
-            {
-                return;
-            }
-
-            _logger.LogDebug("SendAsync Body: {@Body}", body);
             using var httpRequestMessage = new HttpRequestMessage(HttpMethod.Post, option.WebhookUri);
             var contentType = MediaTypeNames.Text.Plain;
             foreach (var header in option.Headers)
@@ -73,13 +66,31 @@ public async Task SendAsync(GenericOption option, Dictionary<string, object> dat
                     && !string.IsNullOrEmpty(header.Value))
                 {
                     contentType = header.Value;
+
+                    // Set the MediaType for the text escape/encode.
+                    if (string.Equals(MediaTypeNames.Application.Json, header.Value, StringComparison.OrdinalIgnoreCase))
+                    {
+                        option.MediaContentType = WebhookMediaContentType.Json;
+                    }
+                    else if (string.Equals(MediaTypeNames.Application.Xml, header.Value, StringComparison.OrdinalIgnoreCase) || string.Equals(MediaTypeNames.Text.Xml, header.Value, StringComparison.OrdinalIgnoreCase))
+                    {
+                        option.MediaContentType = WebhookMediaContentType.Xml;
+                    }
                 }
                 else
                 {
                     httpRequestMessage.Headers.TryAddWithoutValidation(header.Key, header.Value);
                 }
             }
 
+            var body = option.GetMessageBody(data);
+            if (!SendMessageBody(_logger, option, body))
+            {
+                return;
+            }
+
+            _logger.LogDebug("SendAsync Body: {@Body}", body);
+
             httpRequestMessage.Content = new StringContent(body, Encoding.UTF8, contentType);
             using var response = await _httpClientFactory
                 .CreateClient(NamedClient.Default)

Jellyfin.Plugin.Webhook/Destinations/Generic/GenericOption.cs

@@ -14,6 +14,7 @@ public GenericOption()
     {
         Headers = Array.Empty<GenericOptionValue>();
         Fields = Array.Empty<GenericOptionValue>();
+        MediaContentType = WebhookMediaContentType.PlainText;
     }
 
     /// <summary>

Jellyfin.Plugin.Webhook/Destinations/GenericForm/GenericFormOption.cs

@@ -14,6 +14,7 @@ public GenericFormOption()
     {
         Headers = Array.Empty<GenericFormOptionValue>();
         Fields = Array.Empty<GenericFormOptionValue>();
+        // The MediaType is left as JSON because that is what is assumed to be used in GenericFormClient.cs
     }
 
     /// <summary>

Jellyfin.Plugin.Webhook/Destinations/WebhookMediaContentType.cs

@@ -0,0 +1,22 @@
+namespace Jellyfin.Plugin.Webhook.Destinations;
+
+/// <summary>
+/// The type of notification.
+/// </summary>
+public enum WebhookMediaContentType
+{
+    /// <summary>
+    /// Plaintext/Generic Encoding.
+    /// </summary>
+    PlainText = 0,
+
+    /// <summary>
+    /// JSON Encoded webhook payload.
+    /// </summary>
+    Json = 1,
+
+    /// <summary>
+    /// XML Encoded Webhook Payload.
+    /// </summary>
+    Xml = 2,
+}

Jellyfin.Plugin.Webhook/Helpers/DataObjectHelpers.cs

@@ -30,7 +30,7 @@ public static Dictionary<string, object> GetBaseDataObject(IServerApplicationHos
     {
         var dataObject = new Dictionary<string, object>(StringComparer.OrdinalIgnoreCase);
         dataObject["ServerId"] = applicationHost.SystemId;
-        dataObject["ServerName"] = applicationHost.FriendlyName.Escape();
+        dataObject["ServerName"] = applicationHost.FriendlyName;
         dataObject["ServerVersion"] = applicationHost.ApplicationVersionString;
         dataObject["ServerUrl"] = WebhookPlugin.Instance?.Configuration.ServerUrl ?? "localhost:8096";
         dataObject[nameof(NotificationType)] = notificationType.ToString();
@@ -53,11 +53,11 @@ public static Dictionary<string, object> AddBaseItemData(this Dictionary<string,
 
         dataObject["Timestamp"] = DateTime.Now;
         dataObject["UtcTimestamp"] = DateTime.UtcNow;
-        dataObject["Name"] = item.Name.Escape();
-        dataObject["Overview"] = item.Overview.Escape();
-        dataObject["Tagline"] = item.Tagline.Escape();
+        dataObject["Name"] = item.Name;
+        dataObject["Overview"] = item.Overview;
+        dataObject["Tagline"] = item.Tagline;
         dataObject["ItemId"] = item.Id;
-        dataObject["ItemType"] = item.GetType().Name.Escape();
+        dataObject["ItemType"] = item.GetType().Name;
         dataObject["RunTimeTicks"] = item.RunTimeTicks ?? 0;
         dataObject["RunTime"] = TimeSpan.FromTicks(item.RunTimeTicks ?? 0).ToString(@"hh\:mm\:ss", CultureInfo.InvariantCulture);
 
@@ -86,7 +86,7 @@ public static Dictionary<string, object> AddBaseItemData(this Dictionary<string,
             case Season season:
                 if (!string.IsNullOrEmpty(season.Series?.Name))
                 {
-                    dataObject["SeriesName"] = season.Series.Name.Escape();
+                    dataObject["SeriesName"] = season.Series.Name;
                 }
 
                 if (season.Series?.ProductionYear is not null)
@@ -110,7 +110,7 @@ public static Dictionary<string, object> AddBaseItemData(this Dictionary<string,
             case Episode episode:
                 if (!string.IsNullOrEmpty(episode.Series?.Name))
                 {
-                    dataObject["SeriesName"] = episode.Series.Name.Escape();
+                    dataObject["SeriesName"] = episode.Series.Name;
                 }
 
                 if (episode.Series?.Id is not null)
@@ -294,7 +294,7 @@ public static Dictionary<string, object> AddPlaybackProgressData(this Dictionary
     /// <returns>The modified data object.</returns>
     public static Dictionary<string, object> AddUserData(this Dictionary<string, object> dataObject, UserDto user)
     {
-        dataObject["NotificationUsername"] = user.Name.Escape();
+        dataObject["NotificationUsername"] = user.Name;
         dataObject["UserId"] = user.Id;
         dataObject[nameof(user.LastLoginDate)] = user.LastLoginDate ?? DateTime.UtcNow;
         dataObject[nameof(user.LastActivityDate)] = user.LastActivityDate ?? DateTime.MinValue;
@@ -310,7 +310,7 @@ public static Dictionary<string, object> AddUserData(this Dictionary<string, obj
     /// <returns>The modified data object.</returns>
     public static Dictionary<string, object> AddUserData(this Dictionary<string, object> dataObject, User user)
     {
-        dataObject["NotificationUsername"] = user.Username.Escape();
+        dataObject["NotificationUsername"] = user.Username;
         dataObject["UserId"] = user.Id;
         dataObject[nameof(user.LastLoginDate)] = user.LastLoginDate ?? DateTime.UtcNow;
         dataObject[nameof(user.LastActivityDate)] = user.LastActivityDate ?? DateTime.MinValue;
@@ -332,11 +332,11 @@ public static Dictionary<string, object> AddSessionInfoData(this Dictionary<stri
         }
 
         dataObject[nameof(sessionInfo.UserId)] = sessionInfo.UserId;
-        dataObject["NotificationUsername"] = sessionInfo.UserName.Escape();
-        dataObject[nameof(sessionInfo.Client)] = sessionInfo.Client.Escape();
+        dataObject["NotificationUsername"] = sessionInfo.UserName;
+        dataObject[nameof(sessionInfo.Client)] = sessionInfo.Client;
         dataObject[nameof(sessionInfo.LastActivityDate)] = sessionInfo.LastActivityDate;
         dataObject[nameof(sessionInfo.LastPlaybackCheckIn)] = sessionInfo.LastPlaybackCheckIn;
-        dataObject[nameof(sessionInfo.DeviceName)] = sessionInfo.DeviceName.Escape();
+        dataObject[nameof(sessionInfo.DeviceName)] = sessionInfo.DeviceName;
 
         if (!string.IsNullOrEmpty(sessionInfo.DeviceId))
         {
@@ -365,11 +365,11 @@ public static Dictionary<string, object> AddSessionInfoData(this Dictionary<stri
         }
 
         dataObject[nameof(sessionInfo.UserId)] = sessionInfo.UserId;
-        dataObject["NotificationUsername"] = sessionInfo.UserName.Escape();
-        dataObject[nameof(sessionInfo.Client)] = sessionInfo.Client.Escape();
+        dataObject["NotificationUsername"] = sessionInfo.UserName ?? string.Empty;
+        dataObject[nameof(sessionInfo.Client)] = sessionInfo.Client ?? string.Empty;
         dataObject[nameof(sessionInfo.LastActivityDate)] = sessionInfo.LastActivityDate;
         dataObject[nameof(sessionInfo.LastPlaybackCheckIn)] = sessionInfo.LastPlaybackCheckIn;
-        dataObject[nameof(sessionInfo.DeviceName)] = sessionInfo.DeviceName.Escape();
+        dataObject[nameof(sessionInfo.DeviceName)] = sessionInfo.DeviceName ?? string.Empty;
 
         if (!string.IsNullOrEmpty(sessionInfo.DeviceId))
         {
@@ -393,9 +393,9 @@ public static Dictionary<string, object> AddSessionInfoData(this Dictionary<stri
     public static Dictionary<string, object> AddPluginInstallationInfo(this Dictionary<string, object> dataObject, InstallationInfo installationInfo)
     {
         dataObject["PluginId"] = installationInfo.Id;
-        dataObject["PluginName"] = installationInfo.Name.Escape();
+        dataObject["PluginName"] = installationInfo.Name;
         dataObject["PluginVersion"] = installationInfo.Version;
-        dataObject["PluginChangelog"] = installationInfo.Changelog.Escape();
+        dataObject["PluginChangelog"] = installationInfo.Changelog;
         dataObject["PluginChecksum"] = installationInfo.Checksum;
         dataObject["PluginSourceUrl"] = installationInfo.SourceUrl;
 
@@ -410,7 +410,7 @@ public static Dictionary<string, object> AddPluginInstallationInfo(this Dictiona
     /// <returns>The modified data object.</returns>
     public static Dictionary<string, object> AddExceptionInfo(this Dictionary<string, object> dataObject, Exception exception)
     {
-        dataObject["ExceptionMessage"] = exception.Message.Escape();
+        dataObject["ExceptionMessage"] = exception.Message;
         dataObject["ExceptionMessageInner"] = exception.InnerException?.Message ?? string.Empty;
 
         return dataObject;
@@ -440,12 +440,4 @@ public static Dictionary<string, object> AddUserItemData(this Dictionary<string,
 
         return dataObject;
     }
-
-    /// <summary>
-    /// Escape quotes for proper json.
-    /// </summary>
-    /// <param name="input">Input string.</param>
-    /// <returns>Escaped string.</returns>
-    private static string Escape(this string? input)
-        => input?.Replace("\"", "\\\"", StringComparison.Ordinal) ?? string.Empty;
 }