json: improve escaping for script tags.

* lib.c (out_json_str): Strengthen the test for escaping the
forward slash. It has to occur in the sequence </script
rather than just </.  Recognize <!-- and --> in the string,
and encode them.

* tests/010/json.tl: Cover this area with some tests.

* txr.1: Documented.

1 files changed, 12 insertions, 1 deletions

diff --git a/lib.c b/lib.c
index 38837e43..d3ae1425 100644
--- a/lib.c
+++ b/lib.c
@@ -12600,8 +12600,19 @@ static void out_json_str(val str, val out)
       break;
     case '<':
       put_char(chr(ch), out);
-      if (*cstr == '/')
+      if (wcsncmp(cstr, L"/script", 7) == 0) {
         put_char(chr('\\'), out);
+      } else if (wcsncmp(cstr, L"!--", 3) == 0) {
+        put_string(lit("\\u0021"), out);
+        cstr++;
+      }
+      break;
+    case '-':
+      put_char(chr(ch), out);
+      if (wcsncmp(cstr, L"->", 2) == 0) {
+        put_string(lit("\\u002D"), out);
+        cstr++;
+      }
       break;
     case 0xDC00:
       put_string(lit("\\u0000"), out);