diff options
| author | Jean Boussier <jean.boussier@gmail.com> | 2023-04-13 19:22:29 +0200 |
|---|---|---|
| committer | Hiroshi SHIBATA <hsbt@ruby-lang.org> | 2023-12-01 16:47:06 +0900 |
| commit | 0dfeb172968cdaefca2ab828c94d3e5f44d91f8f (patch) | |
| tree | 2850662a485dd3f42068bf14ce4618d77b4b13d6 /test/json/json_generator_test.rb | |
| parent | 698cb8406298ff289ba7abadf34abc3d09a07ef0 (diff) | |
Rename escape_slash in script_safe and also escape E+2028 and E+2029
It is rather common to directly interpolate JSON string inside
<script> tags in HTML as to provide configuration or parameters to a
script.
However this may lead to XSS vulnerabilities, to prevent that 3
characters need to be escaped:
- `/` (forward slash)
- `U+2028` (LINE SEPARATOR)
- `U+2029` (PARAGRAPH SEPARATOR)
The forward slash need to be escaped to prevent closing the script
tag early, and the other two are valid JSON but invalid Javascript
and can be used to break JS parsing.
Given that the intent of escaping forward slash is the same than escaping
U+2028 and U+2029, I chos to rename and repurpose the existing `escape_slash`
option.
Diffstat (limited to 'test/json/json_generator_test.rb')
| -rwxr-xr-x | test/json/json_generator_test.rb | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/test/json/json_generator_test.rb b/test/json/json_generator_test.rb index 64042a4eaf..1bf4912ec7 100755 --- a/test/json/json_generator_test.rb +++ b/test/json/json_generator_test.rb @@ -149,7 +149,7 @@ EOT :ascii_only => false, :buffer_initial_length => 1024, :depth => 0, - :escape_slash => false, + :script_safe => false, :indent => " ", :max_nesting => 100, :object_nl => "\n", @@ -166,7 +166,7 @@ EOT :ascii_only => false, :buffer_initial_length => 1024, :depth => 0, - :escape_slash => false, + :script_safe => false, :indent => "", :max_nesting => 100, :object_nl => "", @@ -183,7 +183,7 @@ EOT :ascii_only => false, :buffer_initial_length => 1024, :depth => 0, - :escape_slash => false, + :script_safe => false, :indent => "", :max_nesting => 0, :object_nl => "", @@ -370,6 +370,18 @@ EOT # data = [ '/' ] json = '["\/"]' + assert_equal json, generate(data, :script_safe => true) + # + data = [ "\u2028\u2029" ] + json = '["\u2028\u2029"]' + assert_equal json, generate(data, :script_safe => true) + # + data = [ "ABC \u2028 DEF \u2029 GHI" ] + json = '["ABC \u2028 DEF \u2029 GHI"]' + assert_equal json, generate(data, :script_safe => true) + # + data = [ "/\u2028\u2029" ] + json = '["\/\u2028\u2029"]' assert_equal json, generate(data, :escape_slash => true) # data = ['"'] |