rails/rails — pull request #10057 by zackham (2013-04-02 20:25:43+00:00)
Title: Escape multibyte line terminators in JSON encoding

Currently, json/encoding respects the JSON spec (as it should) which disallows \n and \r inside strings, escaping them as expected.

Unfortunately, ECMA-262 (Javascript) disallows not only \n and \r in strings, but "Line Terminators" which includes U+2028 and U+2029. See here: http://bclary.com/2004/11/07/#a-7.3

This pull request adds U+2028 and U+2029 to be escaped.

# Why?

It's very common to see something like this in a Rails template:

```

```

If U+2028 or U+2029 are part of any attributes output in the to_json call, you will end up with an exception. In Chrome: Uncaught SyntaxError: Unexpected token ILLEGAL.

In other words, if one of your users pastes something into a textarea that happens to include these fancy unicode line terminators, and you run to_json on that model and stick it in a template, that page is probably broken now.

# Why not?

This is JSON encoding, and the JSON spec is specific about how to encode strings. U+2028 and U+2029 don't get special treatment.

That being said, this is non-obvious, counterintuitive, and can be tough to debug (https://www.google.com/?q=u2028).

What do you do in your apps to deal with this? Is there a convention I'm missing?