encoding/json: add Encoder option to control escaping behavior

[cyberphone]

1. What version of Go are you using? 5.3
2. What operating system and processor architecture are you using? amd64,windows
3. What did you do?

package main

import "fmt"
import "encoding/json"

func main() {
    mapD := map[string]string{"trouble": "</script>"}
    mapB, _ := json.Marshal(mapD)
    fmt.Println(string(mapB))
}

1. What did you expect to see?
   {"trouble":"</script>"}
2. What did you see instead?
   {"trouble":"\u003c/script\u003e"}

Related: #14135

Comment: In my JSON implementation for Java, I have made JavaScript serialization an option. When supplied as JavaScript the above does not break signatures (JSON.stringify() performs the normal serialization), but "on the wire" you should IMHO always use ES6: https://mailarchive.ietf.org/arch/msg/json/I2dF4osWAUlvax48WTxnAei3ldQ

[minux]

JSON is not originally defined by ES6, and the current serialization is perfectly valid JSON, so why should we change? Also, the current behavior fixes a security concern where a browser that incorrectly sniffs content might be tricked to interpret a JSON document as HTML.

[odeke-em]

The reason for this behavior is explained here https://golang.org/pkg/encoding/json/#Marshal

For the time being if this issue is blocking you, please see http://stackoverflow.com/a/25923407.

[cyberphone]

Yes, this is perfectly legal JSON but hardly no other JSON serializer does this.

The use case for following ES6 is enabling "crypto safe" JSON/JavaScript that can travel between different systems without getting corrupted:
https://cyberphone.github.io/openkeystore/resources/docs/jsonsignatures.html

The best solution to this problem is offering different options/modes for serialization which I did in my Java implementation:
https://github.com/cyberphone/openkeystore/blob/master/library/src/org/webpki/json/JSONOutputFormats.java
It wasn't very difficult :-)

[bradfitz]

Let's make this bug about adding a method on json.Encoder to change its quoting behavior. The default will be unchanged.

(a method similar to https://golang.org/pkg/encoding/json/#Decoder.UseNumber or https://tip.golang.org/pkg/encoding/json/#Encoder.Indent)

[cespare]

I can send a CL. (Or does this need more buy-in first?)

[bradfitz]

Send a CL. It has a valid use case for JSON signing, etc.

[gopherbot]

CL https://golang.org/cl/21796 mentions this issue.