From fb89b87efbd8769db97f66fc45c9f88e878ed5af Mon Sep 17 00:00:00 2001
From: Hunter Kehoe <hunter.kehoe@gmail.com>
Date: Sun, 7 Dec 2025 14:06:59 -0700
Subject: [PATCH] do not escape JSON response

---
 server/server.go        | 12 +++++++++---
 server/server_matrix.go |  4 +++-
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/server/server.go b/server/server.go
index fc04d50f..8120b730 100644
--- a/server/server.go
+++ b/server/server.go
@@ -1271,7 +1271,9 @@ func (s *Server) handleBodyAsAttachment(r *http.Request, v *visitor, m *message,
 func (s *Server) handleSubscribeJSON(w http.ResponseWriter, r *http.Request, v *visitor) error {
 	encoder := func(msg *message) (string, error) {
 		var buf bytes.Buffer
-		if err := json.NewEncoder(&buf).Encode(&msg); err != nil {
+		encoder := json.NewEncoder(&buf)
+		encoder.SetEscapeHTML(false)
+		if err := encoder.Encode(&msg); err != nil {
 			return "", err
 		}
 		return buf.String(), nil
@@ -1282,7 +1284,9 @@ func (s *Server) handleSubscribeJSON(w http.ResponseWriter, r *http.Request, v *
 func (s *Server) handleSubscribeSSE(w http.ResponseWriter, r *http.Request, v *visitor) error {
 	encoder := func(msg *message) (string, error) {
 		var buf bytes.Buffer
-		if err := json.NewEncoder(&buf).Encode(&msg); err != nil {
+		encoder := json.NewEncoder(&buf)
+		encoder.SetEscapeHTML(false)
+		if err := encoder.Encode(&msg); err != nil {
 			return "", err
 		}
 		if msg.Event != messageEvent {
@@ -2116,7 +2120,9 @@ func (s *Server) writeJSON(w http.ResponseWriter, v any) error {
 func (s *Server) writeJSONWithContentType(w http.ResponseWriter, v any, contentType string) error {
 	w.Header().Set("Content-Type", contentType)
 	w.Header().Set("Access-Control-Allow-Origin", s.config.AccessControlAllowOrigin) // CORS, allow cross-origin requests
-	if err := json.NewEncoder(w).Encode(v); err != nil {
+	encoder := json.NewEncoder(w)
+	encoder.SetEscapeHTML(false)
+	if err := encoder.Encode(v); err != nil {
 		return err
 	}
 	return nil
diff --git a/server/server_matrix.go b/server/server_matrix.go
index f99bea8f..086585ea 100644
--- a/server/server_matrix.go
+++ b/server/server_matrix.go
@@ -165,7 +165,9 @@ func writeMatrixResponse(w http.ResponseWriter, rejectedPushKey string) error {
 		Rejected: rejected,
 	}
 	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(response); err != nil {
+	encoder := json.NewEncoder(w)
+	encoder.SetEscapeHTML(false)
+	if err := encoder.Encode(response); err != nil {
 		return err
 	}
 	return nil