escapejson 1.0

Compatibility

• v0.x: supports python 2.7 and 3.3, and Django < 3.0.

• v1.x: supports python 3.6+, and Django 1.11+.

Django is not required for use.

Example API usage (with or without Django)

import json
from escapejson import escapejson

my_obj = {'message': '</script><script>alert("oh no!")</script>'}
my_str = json.dumps(myobj)
my_safe_str = escapejson(my_str)

Example Django templates usage

First, add "escapejson" to INSTALLED_APPS in your project’s settings.py.:

# settings.py
INSTALLED_APPS = [
    ...,
    "escapejson",
    ...,
]

Then, use the escapejson library and filter:

{% load escapejson %}

<script>
    var my_obj = {{obj_or_str|escapejson}};
</script>

This filter will attempt to JSON-encode any non-string object that is passed to it before escaping, or just escape any string that is passed to it.

</script> attacks

Any string containing a literal </script> inside javascript within HTML script tags will be interpreted by modern browsers as closing the script tag, resulting at best in broken scripts and syntax errors, and at worst in full-blown XSS. By escaping all / characters as \/ (a valid optional escape in the JSON spec), this is mitigated.

U+2028 and U+2029

Two funky unicode whitespace characters count as valid JSON, but cause syntax errors in javascript. This is mitigated by replacing the literal characters with the strings \u2028 and \u2029. [reference]