See this link:
http://jfire.io/blog/2012/04/30/how-to-securely-bootstrap-json-in-a-rails-view/

We went along the same process as this person lays out, where we started calling .html_safe, which left us open to xss attacks. Since they only recently fixed json_escape in Rails 4, we need to add this custom method to do a "good enough" job.