does the serializer internally use a Json parser ? if yes,is it safe to assume that it would dissalow a piece code enclosed in <script> tags in the case it was passed in to it?
is the Ajax call safe itself? because since it uses Json should the Json also be escaped?
On Monday, October 5, 2015 2:55 PM, Shlomi Fish <shlomif@shlomifish.org> wrote:
Hi Mike,
see below for my response.
On Mon, 5 Oct 2015 06:22:11 +0000 (UTC) Mike Cu <mike_cu80@yahoo.com> wrote:
> I have an Ajax call like : > $( "#City" ).selectmenu({ > select: function( event, ui ) { > $.ajax({ url: '/cities', > type: "POST", > data: {'City':$("#City" > ).val()}}).success(function(data){ $("#display").html(data);}); > }, > > > });
Your indentation in this excerpt of JavaScript code is bad. Please fix it, see:
> does the default JSON serializer escape the data to prevent XSS, or should I > escape it manually?
The JSON serialiser should in general pass the text passed to it as is. As a result, you should make sure to explictly escape it somewhere else (e.g: when passing the data to the .html ( ... ) call).