Why would this have to be escaped? The JSON is not rendered in a HTML view. If you're using JSON to power some model and display that with Rails, we already escape anything output by <%= by default.


On Mar 15, 2013, at 7:28 PM, Matt Colyer <notifications@github.com> wrote:

> In lib/jbuilder.rb:
> 
> > @@ -131,7 +131,7 @@ def attributes!
> >    
> >    # Encodes the current builder as JSON.
> >    def target!
> > -    ActiveSupport::JSON.encode @attributes
> > +    MultiJson.encode @attributes
> 
> This seems somewhat serious. The default configuration makes it incredible easy to have an XSS vulnerability. Is there a good way to ensure that data is escaped by default?
> 
> —
> Reply to this email directly or view it on GitHub.
>