aalmiray/Json-lib — pull request #13 by kohsuke (2013-03-05 23:43:33+00:00)
Title: Stop content sniffing in JSONUtils.quote()

I consider it harmful that `JSONUtils.quote()` behaves differently when the content of the string just so happens to look like a JavaScript function.

While this behavior is documented, I can't think of any valid use case for this --- if you want to produce a JavaScript function, one should have used a `JSONFunction` instance, not a `String` that looks like a function.

With such content sniffing, a calling application cannot safely rely on this function. In certain situations, this can be exploited as a vulnerability I'm building a JSON based on the user input.

The current behaviour also makes it impossible to generate a valid JSON such as:

{"a":"function { something that looks like function }"}

This patch corrects this behaviour.

It is a compatibility breaking change, so this is probably for 3.0, although I suspect hardly anyone would depend on this behaviour.