From 6473e14ba424f2996dac5b653fc2f5f6566ebe31 Mon Sep 17 00:00:00 2001
From: Jean Boussier <byroot@ruby-lang.org>
Date: Sat, 14 Nov 2026 08:34:27 +0100
Subject: [PATCH 1/2] script_safe: compare case insensitively

Followup: https://github.com/ruby/json/pull/1141
---
 ext/json/ext/generator/generator.c   | 37 +++++++++++++++++++++++-----
 java/src/json/ext/StringEncoder.java | 32 ++++++++++++++++++++----
 lib/json/truffle_ruby/generator.rb   | 25 +++++--------------
 test/json/json_generator_test.rb     |  4 +++
 4 files changed, 68 insertions(+), 30 deletions(-)

diff --git a/ext/json/ext/generator/generator.c b/ext/json/ext/generator/generator.c
index b334b993..21ee98b0 100644
--- a/ext/json/ext/generator/generator.c
+++ b/ext/json/ext/generator/generator.c
@@ -536,6 +536,36 @@ static const unsigned char script_safe_escape_table[256] = {
      4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 6, 6, 9, 9,
 };
 
+static inline bool unsafe_html_tag_p(const char *ptr, const char *end)
+{
+    size_t remaining = end - ptr;
+
+    if (remaining < 4) {
+        return false;
+    }
+
+    if (memcmp(ptr, "<!--", 4) == 0) {
+        return true;
+    }
+
+    ptr++;
+    remaining--;
+    if (*ptr == '/') {
+        ptr++;
+        remaining--;
+    }
+
+    return (
+        remaining >= 6 &&
+        (ptr[0] | 0x20) == 's' &&
+        (ptr[1] | 0x20) == 'c' &&
+        (ptr[2] | 0x20) == 'r' &&
+        (ptr[3] | 0x20) == 'i' &&
+        (ptr[4] | 0x20) == 'p' &&
+        (ptr[5] | 0x20) == 't'
+    );
+}
+
 static inline unsigned char search_script_safe_escape(search_state *search)
 {
     while (search->ptr < search->end) {
@@ -545,12 +575,7 @@ static inline unsigned char search_script_safe_escape(search_state *search)
         if (RB_UNLIKELY(ch_len)) {
             if (ch_len & ESCAPE_MASK) {
                 if (RB_UNLIKELY(ch_len == 25)) {
-                    size_t remaining = search->end - search->ptr;
-                    if (!(
-                        (remaining >= 4 && memcmp(search->ptr, "<!--", 4) == 0) ||
-                        (remaining >= 7 && memcmp(search->ptr, "<script", 7) == 0) ||
-                        (remaining >= 8 && memcmp(search->ptr, "</script", 8) == 0)
-                    )) {
+                    if (!unsafe_html_tag_p(search->ptr, search->end)) {
                         search->ptr += 1;
                         continue;
                     }
diff --git a/java/src/json/ext/StringEncoder.java b/java/src/json/ext/StringEncoder.java
index f939a4bd..75e72cdf 100644
--- a/java/src/json/ext/StringEncoder.java
+++ b/java/src/json/ext/StringEncoder.java
@@ -274,6 +274,32 @@ void encodeBasic(ByteList src) throws IOException {
         }
     }
 
+    private boolean isUnsafeScriptTag(byte[] ptrBytes, int pos, int len) {
+      int remaining = len - pos;
+
+      if ((remaining >= 4 && ByteBuffer.wrap(ptrBytes, pos, 4).equals(HTML_COMMENT))) {
+        return true;
+      }
+
+      pos++;
+      remaining--;
+
+      if (ptrBytes[pos] == '/') {
+        pos++;
+        remaining--;
+      }
+
+      return (
+          remaining >= 6 &&
+          (ptrBytes[pos + 0] | 0x20) == 's' &&
+          (ptrBytes[pos + 1] | 0x20) == 'c' &&
+          (ptrBytes[pos + 2] | 0x20) == 'r' &&
+          (ptrBytes[pos + 3] | 0x20) == 'i' &&
+          (ptrBytes[pos + 4] | 0x20) == 'p' &&
+          (ptrBytes[pos + 5] | 0x20) == 't'
+      );
+    }
+
     // C: convert_UTF8_to_JSON
     void encode(ByteList src) throws IOException {
         if (escapeTable == ESCAPE_TABLE) {
@@ -308,11 +334,7 @@ void encode(ByteList src) throws IOException {
                         int remaining = len - pos;
                         if (remaining > 8) remaining = 8;
 
-                        if (
-                          (remaining >= 4 && ByteBuffer.wrap(ptrBytes, pos, 4).equals(HTML_COMMENT)) ||
-                          (remaining >= 7 && ByteBuffer.wrap(ptrBytes, pos, 7).equals(HTML_SCRIPT_OPEN)) ||
-                          (remaining >= 8 && ByteBuffer.wrap(ptrBytes, pos, 8).equals(HTML_SCRIPT_CLOSE))
-                        ) {
+                        if (isUnsafeScriptTag(ptrBytes, pos, len)) {
                           beg = pos = flushPos(pos, beg, ptrBytes, ptr, 1);
                           escapeAscii(ch, scratch, hexdig);
                           break;
diff --git a/lib/json/truffle_ruby/generator.rb b/lib/json/truffle_ruby/generator.rb
index 36837e45..fab06e4f 100644
--- a/lib/json/truffle_ruby/generator.rb
+++ b/lib/json/truffle_ruby/generator.rb
@@ -37,18 +37,12 @@ module Generator
         "\x1f" => '\u001f',
         '"'   =>  '\"',
         '\\'  =>  '\\\\',
+        '<' => '\\u003c',
       }.freeze # :nodoc:
 
       ESCAPE_PATTERN = /["\\\x0-\x1f]/
 
-      script_safe_extra = {
-        '<script' => '\\u003cscript',
-        '</script' => '\\u003c/script',
-        '<!--' => '\\u003c!--',
-      }
-      SCRIPT_SAFE_MAP = MAP.merge(script_safe_extra).freeze
-
-      SCRIPT_SAFE_ESCAPE_PATTERN = Regexp.union(ESCAPE_PATTERN, *script_safe_extra.keys)
+      SCRIPT_SAFE_ESCAPE_PATTERN = Regexp.union(ESCAPE_PATTERN, /<(?=\/?script)/i, /<(?=!--)/)
 
       def self.native_type?(value) # :nodoc:
         (false == value || true == value || nil == value || String === value || Symbol === value || Array === value || Hash === value || Integer === value || Float === value || Fragment === value)
@@ -66,18 +60,11 @@ def self.valid_encoding?(string) # :nodoc:
       # Convert a UTF8 encoded Ruby string _string_ to a JSON string, encoded with
       # UTF16 big endian characters as \u????, and return it.
       def self.utf8_to_json(string, script_safe = false) # :nodoc:
-        if script_safe
-          if SCRIPT_SAFE_ESCAPE_PATTERN.match?(string)
-            string.gsub(SCRIPT_SAFE_ESCAPE_PATTERN, SCRIPT_SAFE_MAP)
-          else
-            string
-          end
+        pattern = script_safe ? SCRIPT_SAFE_ESCAPE_PATTERN : ESCAPE_PATTERN
+        if pattern.match?(string)
+          string.gsub(pattern, MAP)
         else
-          if ESCAPE_PATTERN.match?(string)
-            string.gsub(ESCAPE_PATTERN, MAP)
-          else
-            string
-          end
+          string
         end
       end
 
diff --git a/test/json/json_generator_test.rb b/test/json/json_generator_test.rb
index 3b2fa32a..94f56401 100755
--- a/test/json/json_generator_test.rb
+++ b/test/json/json_generator_test.rb
@@ -761,6 +761,10 @@ def test_script_safe
     data = '<ok><script><!----</script></ok>'
     json = '"<ok>\\u003cscript>\\u003c!----\\u003c/script></ok>"'
     assert_equal json, generate(data, script_safe: true)
+
+    data = '<ok><ScrIpT><!----</sCRiPt></ok>'
+    json = '"<ok>\\u003cScrIpT>\\u003c!----\\u003c/sCRiPt></ok>"'
+    assert_equal json, generate(data, script_safe: true)
   end
 
   def test_backslash

From 88c1da75836d3075937296bfe5691e12ac0eceec Mon Sep 17 00:00:00 2001
From: Jean Boussier <byroot@ruby-lang.org>
Date: Sat, 14 Nov 2026 09:39:28 +0100
Subject: [PATCH 2/2] generator.c: optimize unsafe_html_tag_p2

Favor 4 and 8 byte copies, comparisons and transformations,
as they generate much more efficient code.
---
 ext/json/ext/generator/generator.c | 36 ++++++++++++++----------------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/ext/json/ext/generator/generator.c b/ext/json/ext/generator/generator.c
index 21ee98b0..b33b8ec6 100644
--- a/ext/json/ext/generator/generator.c
+++ b/ext/json/ext/generator/generator.c
@@ -540,30 +540,28 @@ static inline bool unsafe_html_tag_p(const char *ptr, const char *end)
 {
     size_t remaining = end - ptr;
 
-    if (remaining < 4) {
+    if (remaining < 4) return false;
+    if (memcmp(ptr, "<!--", 4) == 0) return true;
+
+    union { uint64_t num; char bytes[8]; } chunk;
+    if (remaining >= 8) {
+        memcpy(chunk.bytes, ptr, 8);
+    }
+    else if (remaining == 7) {
+        chunk.num = 0;
+        memcpy(chunk.bytes, ptr, 7);
+    }
+    else {
         return false;
     }
 
-    if (memcmp(ptr, "<!--", 4) == 0) {
-        return true;
-    }
+    chunk.num |= 0x2020202020202020;
 
-    ptr++;
-    remaining--;
-    if (*ptr == '/') {
-        ptr++;
-        remaining--;
-    }
+    if (memcmp(chunk.bytes, "</script", 8) == 0) return true;
+
+    chunk.bytes[7] = 0;
 
-    return (
-        remaining >= 6 &&
-        (ptr[0] | 0x20) == 's' &&
-        (ptr[1] | 0x20) == 'c' &&
-        (ptr[2] | 0x20) == 'r' &&
-        (ptr[3] | 0x20) == 'i' &&
-        (ptr[4] | 0x20) == 'p' &&
-        (ptr[5] | 0x20) == 't'
-    );
+    return memcmp(chunk.bytes, "<script\0", 8) == 0;
 }
 
 static inline unsigned char search_script_safe_escape(search_state *search)