xss about gon HOT 5 CLOSED

Now I just added helper from rails 3-2-stable branch - escape_javascript - for javascript strings. Later I'll test it more and maybe change logic if there will be problem with unicodes that you named here.

Thank you for your response and I hope you enjoy gon gem)

from gon.

Escape "</" to "</" done in new minor version. If you can write some tests for other line terminators - it will be great!

from gon.

Hey @gazay can you confirm that the latest version of gon indeed escapes like you planned? Thank you!

from gon.

Hey @thbar! Yes, it escapes. Why do you ask?

from gon.

Hi @gazay! Thanks for the confirmation.

I asked because I came across this issue and this article - so I wondered if using gon could be considered a safer way to bootstrap JSON in a script tag, compared to the existing alternatives.

from gon.