gazay/gon — Issue #25: xss
Author: benmmurphy
Created: 2012-02-22 15:34:37+00:00
State: open

gon.my_var = ""

at a minimum you need to escape " \u003C and ">" -> \u003E instead of just escaping the closing tag. i don't know enough about how browsers detect the end of the script tag to know if "<\/" is enough.