diff --git a/CHANGES.rst b/CHANGES.rst
index f3b2fab0..cf47ec8d 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -63,6 +63,7 @@ Unreleased
- The request context does route matching before opening the session.
This could allow a session interface to change behavior based on
``request.endpoint``. :issue:`3776`
+- Use Jinja's implementation of the ``|tojson`` filter. :issue:`3881`
Version 1.1.2
diff --git a/docs/api.rst b/docs/api.rst
index 2df286fa..e6862878 100644
--- a/docs/api.rst
+++ b/docs/api.rst
@@ -250,14 +250,15 @@ for easier customization. By default it handles some extra data types:
- :class:`~markupsafe.Markup` (or any object with a ``__html__``
method) will call the ``__html__`` method to get a string.
-:func:`~htmlsafe_dumps` is also available as the ``|tojson`` template
-filter. The filter marks the output with ``|safe`` so it can be used
-inside ``script`` tags.
+Jinja's ``|tojson`` filter is configured to use Flask's :func:`dumps`
+function. The filter marks the output with ``|safe`` automatically. Use
+the filter to render data inside ``
.. autofunction:: jsonify
diff --git a/docs/patterns/jquery.rst b/docs/patterns/jquery.rst
index b0c0287f..fafbdf18 100644
--- a/docs/patterns/jquery.rst
+++ b/docs/patterns/jquery.rst
@@ -60,27 +60,9 @@ like this:
.. sourcecode:: html+jinja
-The ``|safe`` is necessary in Flask before 0.10 so that Jinja does not
-escape the JSON encoded string with HTML rules. Usually this would be
-necessary, but we are inside a ``script`` block here where different rules
-apply.
-
-.. admonition:: Information for Pros
-
- In HTML the ``script`` tag is declared ``CDATA`` which means that entities
- will not be parsed. Everything until ```` is handled as script.
- This also means that there must never be any ```` between the script
- tags. ``|tojson`` is kind enough to do the right thing here and
- escape slashes for you (``{{ ""|tojson|safe }}`` is rendered as
- ``"<\/script>"``).
-
- In Flask 0.10 it goes a step further and escapes all HTML tags with
- unicode escapes. This makes it possible for Flask to automatically
- mark the result as HTML safe.
-
JSON View Functions
-------------------
diff --git a/docs/templating.rst b/docs/templating.rst
index bf18426b..b0964df8 100644
--- a/docs/templating.rst
+++ b/docs/templating.rst
@@ -95,37 +95,6 @@ by default:
{% from '_helpers.html' import my_macro with context %}
-Standard Filters
-----------------
-
-Flask provides the following Jinja2 filters in addition to the filters provided
-by Jinja2 itself:
-
-.. function:: tojson
- :noindex:
-
- This function converts the given object into JSON representation. This
- is for example very helpful if you try to generate JavaScript on the
- fly.
-
- .. sourcecode:: html+jinja
-
-
-
- It is also safe to use the output of `|tojson` in a *single-quoted* HTML
- attribute:
-
- .. sourcecode:: html+jinja
-
-
-
- Note that in versions of Flask prior to 0.10, if using the output of
- ``|tojson`` inside ``script``, make sure to disable escaping with ``|safe``.
- In Flask 0.10 and above, this happens automatically.
Controlling Autoescaping
------------------------
diff --git a/src/flask/app.py b/src/flask/app.py
index e58ee983..87058495 100644
--- a/src/flask/app.py
+++ b/src/flask/app.py
@@ -681,7 +681,7 @@ class Flask(Scaffold):
session=session,
g=g,
)
- rv.filters["tojson"] = json.tojson_filter
+ rv.policies["json.dumps_function"] = json.dumps
return rv
def create_global_jinja_loader(self):
diff --git a/src/flask/json/__init__.py b/src/flask/json/__init__.py
index f6feeb23..6d7fe564 100644
--- a/src/flask/json/__init__.py
+++ b/src/flask/json/__init__.py
@@ -5,7 +5,7 @@ import warnings
from datetime import date
from datetime import datetime
-from markupsafe import Markup
+from jinja2.utils import htmlsafe_json_dumps as _jinja_htmlsafe_dumps
from werkzeug.http import http_date
from ..globals import current_app
@@ -234,30 +234,28 @@ def load(fp, app=None, **kwargs):
return _json.load(fp, **kwargs)
-_htmlsafe_map = str.maketrans(
- {"<": "\\u003c", ">": "\\u003e", "&": "\\u0026", "'": "\\u0027"}
-)
-
-
def htmlsafe_dumps(obj, **kwargs):
- """Serialize an object to a string of JSON, replacing HTML-unsafe
- characters with Unicode escapes. Otherwise behaves the same as
- :func:`dumps`.
+ """Serialize an object to a string of JSON with :func:`dumps`, then
+ replace HTML-unsafe characters with Unicode escapes and mark the
+ result safe with :class:`~markupsafe.Markup`.
- This is available in templates as the ``|tojson`` filter, which will
- also mark the result with ``|safe``.
+ This is available in templates as the ``|tojson`` filter.
The returned string is safe to render in HTML documents and
``")
- assert rv == '"\\u003c/script\\u003e"'
- rv = render('{{ ""|tojson }}')
- assert rv == '"\\u003c/script\\u003e"'
- rv = render('{{ "<\0/script>"|tojson }}')
- assert rv == '"\\u003c\\u0000/script\\u003e"'
- rv = render('{{ "