codahale/dropwizard — pull request #104 by al3x (2012-05-30 04:19:31+00:00)
Title: JSON error messages on entity validation and as the server error handler

Replaces QuietErrorHandler with JsonErrorHandler, a slightly modified version of the original that returns error messages as a JSON document.

A similar pattern is used for returning entity validation errors as JSON.

The main motivation for this change to is prevent reflected XSS attacks by not returning client-controlled values in a format that could result in script execution in some browser scenarios. With client-controlled values safely formatted in JSON documents, achieving script execution should be far more difficult for an attacker.

Note that I haven't modified the 500 plain text response returned by `com.yammer.dropwizard.jersey.LoggingExceptionMapper`. It may make sense to have that return JSON for consistency, but it does not reflect any client-controlled values and as such poses no known security risk.