forked from orbit-oss/flask
Fixed a security problem caused by changed simplejson semantics.
Notice: this was never in a release version of Flask.
This commit is contained in:
parent
07e515b071
commit
ade490514d
4 changed files with 16 additions and 2 deletions
|
|
@ -77,7 +77,8 @@ inside a `script` block here where different rules apply.
|
|||
will not be parsed. Everything until ``</script>`` is handled as script.
|
||||
This also means that there must never be any ``</`` between the script
|
||||
tags. ``|tojson`` is kindly enough to do the right thing here and
|
||||
escape backslashes for you.
|
||||
escape slashes for you (``{{ "</script>"|tojson|safe }`` is rendered as
|
||||
``"<\/script>"``).
|
||||
|
||||
|
||||
JSON View Functions
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue