-
Notifications
You must be signed in to change notification settings - Fork 321
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add forward slash as escape character #235
Conversation
1009911
to
a41ce74
Compare
yes, seems a security issue. |
@flori, for review please? |
@flori an answer would be really nice! |
Well, according to the spec the forward slash may be escaped, not should be escaped. It's also not a security issue of JSON itself but of the browser interpreting Javascript in an inline script tag. You really have to try hard though and combine several bad practices: like not checking/sanitising user input and using inline script tags in the first place. On the other hand always escaping the forward slash would make all JSON output containing URLs, filepathes, etc. to be unreadable even though JSON is often stored in flat files, databases, used in over the wire protocols and returned by web APIs that have nothing at all to do with inline script tags. The question is, is that really worth it? Other JSON implementations usually don't offer the escaping or do it only on demand. On the ones I found that do it in general it is often reported as a bug. I would prefer it if you could make this configurable and not the default output, so people can use the escaping if they need to without making the JSON unreadable in every other application. |
Sounds reasonable, I'll work on it. Thanks for the feedback, much appreciated. |
369ee34
to
ff4fbcc
Compare
I have added a configuration option that is disabled by default but where users of this gem will be able to opt-in the new behavior of escaping slashes. Can you review/give feedback on this? |
@flori are you ok with this PR? If so we will rebase it. |
Bump. |
I rebased this and opened another PR: #405 |
Should be closed. |
As per the spec, the forward slash should be escaped in json strings. Not escaping the forward slash causes a security issue when a json object is interpolated inside of a script tag.
For instance:
In javascript
</script>
has precedence over everything else, so in this case the script tag is terminated andwhatever()
is executed even though it should be part of the string.The correct way to defend against this security issue is to escape the forward slash, so that
<\/script>
does not terminate the original script tag and the json string stays a string.@flori