flori/json — Issue #110: JSON output should prevent content-sniffing
Author: meder
Created: 2011-12-12 23:35:08+00:00
State: open

To ensure that JSON output of this library doesn't result in cross-site scripting(XSS) due to content-sniffing [1] please add the following:

- Use \xNN escape sequences to substitute characters in the 0x00 - 0x1F range, <, >, and any characters above 0x7F.
- Add 'Content-Disposition: attachment' header to discourage browsers/plugins from rendering data

1. http://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors