diaspora/config/initializers/json_escape.rb
Jonne Haß 7134513b28 Fix XSS vulnerabilities caused by not escaping a users name fields when loading it from JSON. #3948
From a quick look at the for us available databases this was not actually used in the wild.
2013-02-01 22:20:31 +01:00

11 lines
301 B
Ruby

# From http://jfire.io/blog/2012/04/30/how-to-securely-bootstrap-json-in-a-rails-view/
# Review on Rails 4 update, might be built in by then!
class ActionView::Base
def json_escape(s)
result = s.to_s.gsub('/', '\/')
s.html_safe? ? result.html_safe : result
end
alias j json_escape
end