json_escape eats away double quotes

verified

+1 The above patch works. Applied it to 2-3-stable and ran tests to see it working.

verified

-1 This is the expected behavior according to Michael Koziarski.

In the example in the RDoc for json_escape, assuming @person was an Active Record object, to_json would serialize it into a JSON object in which the keys are quoted and string values are too, json_escape would make the JSON invalid.

From the documentation:

  <%=j @person.to_json %>

It would output something like this:

  {person:{name:John Doe,created_at:2010-04-28T00:15:24Z,updated_at:2010-04-28T00:19:30Z,id:1}}

The only use I can think of is (as long as you don't need quotes in the string):

  <script type="text/javascript">
  var my_string = "My templated JSON string within HTML <%=j @ruby_string.to_json %>";
  </script>

Is the output of json_escape intended to not output a complete JSON value? Just partial JSON string value without any backslash handling?

I guess I don't really understand when someone would use json_escape. At least, this ticket should not have been marked invalid without changing the RDoc.

Seems more useful if to_json could take an option to encode HTML special chars as it was generating the json.

Was this doc patch applied?

+1 to Neeraj's patch, but I guess you should reroll it to only include this change (it contains an unrelated patch that has already been committed).

Andrea, You can make changes directly here: http://github.com/lifo/docrails the changes are later merged into the main Rails repo after review. Also remember to follow the guidelines provided here — http://guides.rubyonrails.org/api_documentation_guidelines.html — and do report back so that this ticket can be closed. Thanks! :)

Committed in a38e653a6d512de3d221

The incorrect behaviour is still in Rails 3.0.3. So <%=j @person.to_json %> is still in the 3.0.3 docs and still produces invalid output. Do we need a new ticket for this?

I can't think of any prominent use case for an escape helper that eats double quotes. It even eats quotes when they are escaped with " and then leaves the \ which results in odd control characters in your JSON string that potentially do more harm then good.

I think it should be fixed to leave the quotes. The use case in the docs <%= j @person.to_json %> is not covered by any of the other escape helpers right now. I went back to setting ActiveSupport.escape_html_entities_in_json = true in the initializers and removing the j altogether.

This is STILL a fail for me. Is there ANY point to json_escape at all? It seems completely useless to me.

@Michael Koziarski "It returns the strings without dangerous characters"

That's not quite true:
json_escape('hi \"now\"') # => 'hi \now\'

This will insert a spurious new line, but you can insert any other control character this way, typically breaking stuff.

This issue has been automatically marked as stale because it has not been commented on for at least three months.

The resources of the Rails core team are limited, and so we are asking for your help. If you can still reproduce this error on the 3-0-stable branch or on master, please reply with all of the information you have about it and add "[state:open]" to your comment. This will reopen the ticket for review. Likewise, if you feel that this is a very important feature for Rails to include, please reply with your explanation so we can consider it.

Thank you for all your contributions, and we hope you will understand this step to focus our efforts where they are most helpful.