Cross-site Scripting (XSS) Through Unescaped JSON String in petems/tugboat (master)

[petems]

Cross-site Scripting (XSS) Through Unescaped JSON String in petems/tugboat (master)

Issue Details

• Vulnerability: Cross-site Scripting (XSS) Through Unescaped JSON String
• Severity: Medium
• Project: petems/tugboat
• Branch: master
• Scan Date: Jul 3, 2017 12:01:10

Issue Decription

There is an XSS vulnerability in the ActiveSupport::JSON.encode method in in json/encoding.rb for Ruby on Rails. When a 'Hash' containing user-controlled data is encoded as JSON (either through 'Hash#to_json' or 'ActiveSupport::JSON.encode'), Rails does not perform adequate escaping that matches the guarantee implied by the 'escape_html_entities_in_json' option (which is enabled by default). If this resulting JSON string is subsequently inserted directly into an HTML page, the page will be vulnerable to XSS attacks.

View more details