diff options
| -rw-r--r-- | actionview/CHANGELOG.md | 4 | ||||
| -rw-r--r-- | activesupport/lib/active_support/core_ext/string/output_safety.rb | 61 |
2 files changed, 53 insertions, 12 deletions
diff --git a/actionview/CHANGELOG.md b/actionview/CHANGELOG.md index d53b321f97..65d045d1f7 100644 --- a/actionview/CHANGELOG.md +++ b/actionview/CHANGELOG.md @@ -1,3 +1,7 @@ +* Fixed a long-standing bug in `json_escape` that causes quotation marks to be stripped. + + *Godfrey Chan* + * `ActionView::MissingTemplate` includes underscore when raised for a partial. Fixes #13002. diff --git a/activesupport/lib/active_support/core_ext/string/output_safety.rb b/activesupport/lib/active_support/core_ext/string/output_safety.rb index c21650bb83..d54265f1b1 100644 --- a/activesupport/lib/active_support/core_ext/string/output_safety.rb +++ b/activesupport/lib/active_support/core_ext/string/output_safety.rb @@ -6,7 +6,7 @@ class ERB HTML_ESCAPE = { '&' => '&', '>' => '>', '<' => '<', '"' => '"', "'" => ''' } JSON_ESCAPE = { '&' => '\u0026', '>' => '\u003E', '<' => '\u003C' } HTML_ESCAPE_ONCE_REGEXP = /["><']|&(?!([a-zA-Z]+|(#\d+));)/ - JSON_ESCAPE_REGEXP = /[&"><]/ + JSON_ESCAPE_REGEXP = /[&><]/ # A utility method for escaping HTML tag characters. # This method is also aliased as <tt>h</tt>. @@ -48,17 +48,54 @@ class ERB module_function :html_escape_once - # A utility method for escaping HTML entities in JSON strings - # using \uXXXX JavaScript escape sequences for string literals: - # - # json_escape('is a > 0 & a < 10?') - # # => is a \u003E 0 \u0026 a \u003C 10? - # - # Note that after this operation is performed the output is not - # valid JSON. In particular double quotes are removed: - # - # json_escape('{"name":"john","created_at":"2010-04-28T01:39:31Z","id":1}') - # # => {name:john,created_at:2010-04-28T01:39:31Z,id:1} + # A utility method for escaping HTML entities in JSON strings. Specifically, the + # &, > and < characters are replaced with their equivilant unicode escaped form - + # \u0026, \u003e, and \u003c. These sequences has identical meaning as the original + # characters inside the context of a JSON string, so assuming the input is a valid + # and well-formed JSON value, the output will have equivilant meaning when parsed: + # + # json = JSON.generate({ name: "</script><script>alert('PWNED!!!')</script>"}) + # # => "{\"name\":\"</script><script>alert('PWNED!!!')</script>\"}" + # + # json_escape(json) + # # => "{\"name\":\"\\u003C/script\\u003E\\u003Cscript\\u003Ealert('PWNED!!!')\\u003C/script\\u003E\"}" + # + # JSON.parse(json) == JSON.parse(json_escape(json)) + # # => true + # + # The intended use case for this method is to escape JSON strings before including + # them inside a script tag to avoid XSS vulnerability: + # + # <script type="application/javascript"> + # var currentUser = <%= json_escape current_user.to_json %>; + # </script> + # + # WARNING: this helper only works with valid JSON. Using this on non-JSON values + # will open up serious XSS vulnerabilities. For example, if you replace the + # +current_user.to_json+ in the example above with user input instead, the browser + # will happily eval() that string as JavaScript. + # + # The escaping performed in this method is identical to those performed in the + # ActiveSupport JSON encoder when +ActiveSupport.escape_html_entities_in_json+ is + # set to true. Because this transformation is idempotent, this helper can be + # applied even if +ActiveSupport.escape_html_entities_in_json+ is already true. + # + # Therefore, when you are unsure if +ActiveSupport.escape_html_entities_in_json+ + # is enabled, or if you are unsure where your JSON string originated from, it + # is recommended that you always apply this helper (other libraries, such as the + # JSON gem, does not provide this kind of protection by default; also some gems + # might override +#to_json+ to bypass ActiveSupport's encoder). + # + # The output of this helper method is marked as HTML safe so that you can directly + # include it inside a +<script>+ tag as shown above. + # + # However, it is NOT safe to use the output of this inside an HTML attribute, + # because quotation marks are not escaped. Doing so might break your page's layout. + # If you intend to use this inside an HTML attribute, you should use the + # +html_escape+ helper (or its +h+ alias) instead: + # + # <div data-user-info="<%= h current_user.to_json %>">...</div> + # def json_escape(s) result = s.to_s.gsub(JSON_ESCAPE_REGEXP, JSON_ESCAPE) s.html_safe? ? result.html_safe : result |