Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Fixed a long-standing bug in `json_escape` that strips quotation marks

  • Loading branch information...
commit 2f1c5789c1882413df0346fec1f29eed24f37698 1 parent 039f9b3
@chancancode chancancode authored
View
4 actionview/CHANGELOG.md
@@ -1,3 +1,7 @@
+* Fixed a long-standing bug in `json_escape` that causes quotation marks to be stripped.
+
+ *Godfrey Chan*
+
* `ActionView::MissingTemplate` includes underscore when raised for a partial.
Fixes #13002.
View
61 activesupport/lib/active_support/core_ext/string/output_safety.rb
@@ -6,7 +6,7 @@ module Util
HTML_ESCAPE = { '&' => '&amp;', '>' => '&gt;', '<' => '&lt;', '"' => '&quot;', "'" => '&#39;' }
JSON_ESCAPE = { '&' => '\u0026', '>' => '\u003E', '<' => '\u003C' }
HTML_ESCAPE_ONCE_REGEXP = /["><']|&(?!([a-zA-Z]+|(#\d+));)/
- JSON_ESCAPE_REGEXP = /[&"><]/
+ JSON_ESCAPE_REGEXP = /[&><]/
# A utility method for escaping HTML tag characters.
# This method is also aliased as <tt>h</tt>.
@@ -48,17 +48,54 @@ def html_escape_once(s)
module_function :html_escape_once
- # A utility method for escaping HTML entities in JSON strings
- # using \uXXXX JavaScript escape sequences for string literals:
- #
- # json_escape('is a > 0 & a < 10?')
- # # => is a \u003E 0 \u0026 a \u003C 10?
- #
- # Note that after this operation is performed the output is not
- # valid JSON. In particular double quotes are removed:
- #
- # json_escape('{"name":"john","created_at":"2010-04-28T01:39:31Z","id":1}')
- # # => {name:john,created_at:2010-04-28T01:39:31Z,id:1}
+ # A utility method for escaping HTML entities in JSON strings. Specifically, the
+ # &, > and < characters are replaced with their equivilant unicode escaped form -
+ # \u0026, \u003e, and \u003c. These sequences has identical meaning as the original
+ # characters inside the context of a JSON string, so assuming the input is a valid
+ # and well-formed JSON value, the output will have equivilant meaning when parsed:
+ #
+ # json = JSON.generate({ name: "</script><script>alert('PWNED!!!')</script>"})
+ # # => "{\"name\":\"</script><script>alert('PWNED!!!')</script>\"}"
+ #
+ # json_escape(json)
+ # # => "{\"name\":\"\\u003C/script\\u003E\\u003Cscript\\u003Ealert('PWNED!!!')\\u003C/script\\u003E\"}"
+ #
+ # JSON.parse(json) == JSON.parse(json_escape(json))
+ # # => true
+ #
+ # The intended use case for this method is to escape JSON strings before including
+ # them inside a script tag to avoid XSS vulnerability:
+ #
+ # <script type="application/javascript">
+ # var currentUser = <%= json_escape current_user.to_json %>;
+ # </script>
+ #
+ # WARNING: this helper only works with valid JSON. Using this on non-JSON values
+ # will open up serious XSS vulnerabilities. For example, if you replace the
+ # +current_user.to_json+ in the example above with user input instead, the browser
+ # will happily eval() that string as JavaScript.
+ #
+ # The escaping performed in this method is identical to those performed in the
+ # ActiveSupport JSON encoder when +ActiveSupport.escape_html_entities_in_json+ is
+ # set to true. Because this transformation is idempotent, this helper can be
+ # applied even if +ActiveSupport.escape_html_entities_in_json+ is already true.
+ #
+ # Therefore, when you are unsure if +ActiveSupport.escape_html_entities_in_json+
+ # is enabled, or if you are unsure where your JSON string originated from, it
+ # is recommended that you always apply this helper (other libraries, such as the
+ # JSON gem, does not provide this kind of protection by default; also some gems
+ # might override +#to_json+ to bypass ActiveSupport's encoder).
+ #
+ # The output of this helper method is marked as HTML safe so that you can directly
+ # include it inside a +<script>+ tag as shown above.
+ #
+ # However, it is NOT safe to use the output of this inside an HTML attribute,
+ # because quotation marks are not escaped. Doing so might break your page's layout.
+ # If you intend to use this inside an HTML attribute, you should use the
+ # +html_escape+ helper (or its +h+ alias) instead:
+ #
+ # <div data-user-info="<%= h current_user.to_json %>">...</div>
+ #
def json_escape(s)
result = s.to_s.gsub(JSON_ESCAPE_REGEXP, JSON_ESCAPE)
s.html_safe? ? result.html_safe : result
Please sign in to comment.
Something went wrong with that request. Please try again.