Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

render :json don't escape htmlentities.

#6025

XSS happend by IE6 and IE7.

app/controllers/json_controller.rb

class JsonController < ApplicationController
  def index
    xss = "<script>alert('hoge')</script>"
    render :json => {:a => xss }
  end
end

config/routes.rb

RenderJsonXss::Application.routes.draw do
  root :to => 'json#index'
end

and access to http://localhost:3000/.html with IE6 or IE7.
response:

{"a":"<script>alert('hoge')</script>"}

I think render :json should escape htmlentities.

Reported by Tohru Hashimoto · November 21st, 2010 @ 07:00 AM

Activity

Andrés Mejía
-1 on this.

Why would you directly access an action that renders JSON in the first place?

I don't really see how could this be used for an XSS attack. Mind explaining?

And if you really want to escape the content, you can use:
```
    render :json => {:a => CGI::escape(xss) }
```
But I don't see any reason for this to be the default behavior.
November 21st, 2010 @ 03:04 PM
rails
- State changed from new to open
This issue has been automatically marked as stale because it has not been commented on for at least three months.

The resources of the Rails core team are limited, and so we are asking for your help. If you can still reproduce this error on the 3-0-stable branch or on master, please reply with all of the information you have about it and add "[state:open]" to your comment. This will reopen the ticket for review. Likewise, if you feel that this is a very important feature for Rails to include, please reply with your explanation so we can consider it.

Thank you for all your contributions, and we hope you will understand this step to focus our efforts where they are most helpful.

February 22nd, 2011 @ 12:00 AM
rails
- State changed from open to stale
February 22nd, 2011 @ 12:00 AM