> https://github.com/flori/json/pull/525
> Rename escape_slash in script_safe and also escape E+2028 and E+2029
Co-authored-by: Jean Boussier <jean.boussier@gmail.com>
> https://github.com/flori/json/pull/454
> Remove unnecessary initialization of create_id in JSON.parse()
Co-authored-by: Watson <watson1978@gmail.com>
It is rather common to directly interpolate JSON string inside
<script> tags in HTML as to provide configuration or parameters to a
script.
However this may lead to XSS vulnerabilities, to prevent that 3
characters need to be escaped:
- `/` (forward slash)
- `U+2028` (LINE SEPARATOR)
- `U+2029` (PARAGRAPH SEPARATOR)
The forward slash need to be escaped to prevent closing the script
tag early, and the other two are valid JSON but invalid Javascript
and can be used to break JS parsing.
Given that the intent of escaping forward slash is the same than escaping
U+2028 and U+2029, I chos to rename and repurpose the existing `escape_slash`
option.
```
[ 3463/25719] JSONGeneratorTest#test_string_ext_included_calls_super/home/chkbuild/chkbuild/tmp/build/20230905T063003Z/ruby/test/json/json_generator_test.rb:411: warning: method redefined; discarding old included
/home/chkbuild/chkbuild/tmp/build/20230905T063003Z/ruby/test/json/json_generator_test.rb:399: warning: previous definition of included was here
```
http://rubyci.s3.amazonaws.com/debian10/ruby-master/log/20230905T063003Z.log.html.gz
The C extension defines an `included` hook for the
`JSON::Ext::Generator::GeneratorMethods::String` module but neglects to
call `super` in the hook. This can break the functionality of various
other code that rely on the fact that `included` on `Module` will always
be called.
https://github.com/flori/json/commit/cd8bbe56a3
* test/json/json_generator_test.rb (test_broken_bignum): get rid
of use of Bignum, obsolete name.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56126 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
upstream.
* test/json: merge original test files from json upstream.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55667 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Hiroshi SHIBATA
Jean Boussier
Yusuke Endoh
Peter Zhu
Takashi Kokubun
Nobuyoshi Nakada
Ufuk Kayserilioglu
Kenta Murata
Chris Seaton
Kazuhiro NISHIYAMA
Karol Bucek
Aaron Patterson
hsbt
nobu