Skip to content

JSON Output

What does this mean ?

Escaping HTML source code is set to disable on a JSON output; this may lead to stored cross-site scripting vulnerability as the HTML output is returned without escaping it

What can happen ?

Unfiltered HTML may lead to executing Javascript and HTML source code in the returned response and allow the attacker to have a stored cross-site scripting vulnerability on the system which may lead to stealing user's data

Recommendation

it's recommended to enable scaping HTML on a JSON output by seting escape_html_entities_in_json to true

Sample Code

Vulnerable :

escape_html_entities_in_json = false

Non Vulnerable :

escape_html_entities_in_json = true

References