Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make it possible to escape special characters on serialization #265

Closed
Actine opened this issue May 1, 2014 · 1 comment
Closed

Make it possible to escape special characters on serialization #265

Actine opened this issue May 1, 2014 · 1 comment

Comments

@Actine
Copy link

Actine commented May 1, 2014

It's a good practice to convert the following special characters: < > " & ' into their respective hex representation: \u003C, \u003E, \u0022, \u0026 and \u0027: it mitigates some XSS while remaining valid JSON.
Symfony2's JsonResponse does this escaping, don't see why JMSSerializer shouldn't.
Sorry if dup bug.

@Actine
Copy link
Author

Actine commented May 1, 2014

Sorry, false alarm. Read some docs, found the way.
It can be configured in the following way:

# config.yml or wherever
jms_serializer:
    visitors:
        json:
            options: 15

where 15 is a bitmask of JSON_HEX_TAG + JSON_HEX_AMP + JSON_HEX_APOS + JSON_HEX_QUOT

@Actine Actine closed this as completed May 1, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant