yahoo/express-state — pull request #13 by ericf (2013-10-16 05:05:23+00:00)
Title: Encode unsafe HTML chars in string values during serialization

This helps Express State protect against XSS attacks if untrust user input it passed to `expose()` without being escaped first. Fixes #11

After several discussions with @caridy and consulting @rgrove on this problem, I've settled on this solution which encodes unsafe HTML chars in string values during the serialization process. Unsafe HTML characters in string values are now encoded to their Unicode counterparts, the encoded characters will `===` the non-encoded characters so there's no worry of this messing up application code.

With this change, the following will no long cause the browser issue an alert:

```javascript
res.expose('";', 'foo');
```

When the above string is serialized, its `'<'`, `'>'`, and `'/'` chars are encoded to their Unicode values which are `===`, and the browser won't treat `"\u003C\u002Fscript\u003E"` as a closing `` tag.