ServiceStack/ServiceStack — pull request #134 by sneal (2012-04-12 22:51:19+00:00)
Title: Fixed Issue120 - XSS in HTML view

Commit 8a605dce:
I extracted the HTML template into its own file as an embedded resource which is cached in a static field (last write wins).

I replaced the string.Format() with Replace() and used named parameters like ${Dto} because the HTML view no longer double escapes { and } to make it easier to work with, but that breaks the .NET format method.

Commit dad0f02e:
I fixed the actual defect by escaping < and > in the serialized JSON string. The JSON object is directly emitted onto the page rather then deserialized from an element. I also changed the 'view json' to take the model that is directly emitted and stringify-ing it (I inverted the serialization)