goinstant/secure-filters — pull request #27 by stash (2014-09-24 21:56:37+00:00)
Title: Aggressive jsObj escaping

Previously, we had the punctuation characters `",-.:[\]_{}` allowed in the `jsObj` filter. This was mostly so the built-in `JSON.stringify` could be used without a `replacer` parameter for speed. However, this potentially allows for hijinx and other nonsense. This patch reduces the allowed punctuation to just `,.-_`, which is the same as for the `js` filter.