mernen/json-jruby — Issue #8: JSON output should prevent content-sniffing
Author: igrigorik
Created: 2012-01-13 05:41:38+00:00
State: open

Sister bug to: https://github.com/flori/json/issues/110

To ensure that JSON output of this library doesn't result in cross-site scripting(XSS) due to content-sniffing [1] the following characters should use \xNN escape sequences to substitute characters in the 0x00 - 0x1F range, <, >, and any characters above 0x7F.

Daniel, what are your thoughts on this? Downstream parsers should decode this just fine, but this would prevent (by default) a range of attacks when JSON is used on the web.

http://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors