Ensure HTML entities are escaped in JSON

문서 > 코드 분석 > Static Analysis Rules > Ensure HTML entities are escaped in JSON

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: ruby-security/rails-escape-json-entities

Language: Ruby

Severity: Warning

Category: Security

Description

This rule is designed to ensure that HTML entities are escaped when they are included in JSON. Escaping HTML entities in JSON is important because it helps to prevent cross-site scripting (XSS) attacks. XSS attacks can allow attackers to inject malicious scripts into web pages viewed by other users, leading to a wide range of potential security issues.

The ActiveSupport.escape_html_entities_in_json configuration option in Ruby on Rails controls whether or not HTML entities are escaped in JSON. By default, this option is set to false. However, for better security, it should be set to true.

To avoid violating this rule, always set ActiveSupport.escape_html_entities_in_json = true in your Ruby on Rails applications. This will ensure that any HTML entities that are included in your JSON are properly escaped, helping to protect your application from potential XSS attacks.

Non-Compliant Code Examples

ActiveSupport.escape_html_entities_in_json = false

Compliant Code Examples

ActiveSupport.escape_html_entities_in_json = true