Print valid, non-escaped JSON in a view with Rails

Question

I've tried everything. Every combination of the helpers raw, html_safe to_json including some attempts with ::JSON.encode and CGI.unescape. The issue is that regardless of what I do, I can't print well-formed JSON in a view. It's always HTML escaped.

Here's the code in my view:

var campaignData<%= "=" + (raw @campaign.to_json) if @campaign %>;

In my case, it's always the quotes that are escaped as ". I would just do a gsub on the quotes, but that is a terrible solution to what IMO ought to be a very simple, well documented use case.

Roman · Accepted Answer · 2012-07-01 09:22:12Z

33

+50

The problem here is with the "=" string. As it's considered unsafe, it taints the other string.

You can probably do either:

raw("=" + @campaign.to_json)

or

"= #{@campaign.to_json}".html_safe

which are roughly the same.

answered Jul 1, 2012 at 9:22

Roman

13.1k4 gold badges50 silver badges63 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Kelvin Over a year ago

This is unsafe. What if the json contains a string with a less-than? If you put this in a script tag, someone can inject a closing script tag and start a new one with arbitrary code. You need to wrap the json string in json_escape. However, that function has been broken until just recently (rails 4.1).

hrdwdmrbl Over a year ago

Yes, I too found that this did not work for me when @campaign == "<script>alert('pwn')</script>"

Jesse Whitham · Accepted Answer · 2016-08-03 23:27:13Z

15

Since ActiveSupport 2.3.3 you have been able to do .as_json

edited Aug 3, 2016 at 23:27

answered Mar 3, 2015 at 3:07

Jesse Whitham

82410 silver badges32 bronze badges

Comments

cutalion · Accepted Answer · 2012-03-14 00:40:59Z

5

Did you try escape_javascript?

Here is an example from the *.haml file, which I just added to test my answer.

:javascript
  var foo=$.parseJSON("#{j @albums.to_json}")

Where j is an short alias for escape_javascript.

answered Mar 14, 2012 at 0:40

cutalion

4,3941 gold badge42 silver badges49 bronze badges

4 Comments

D-Nice Over a year ago

Yea, that didn't work. Right now I'm just manually printing each value that I need, which is an awful solution, but its the only way I've been able to make it work.

cutalion Over a year ago

Could you paste here a bit of your escaped string? Also, which version of ruby and rails do you use? Just wondering what could be wrong with that

D-Nice Over a year ago

It was valid JSON, except the quotes were replaced with the HTML quote entity " Using Rails 3.2.1

dB. Over a year ago

This was the best solution for me. I already have a model that returns valid JSON, but characters like \u2028 won't parse if included in the bootstrapped HAML.

megas · Accepted Answer · 2012-07-01 08:07:13Z

0

Try this with utility method

var campaignData<%=h " =#{raw @campaign.to_json}" if @campaign %>;

edited Jul 1, 2012 at 8:07

answered Jul 1, 2012 at 8:01

megas

21.9k12 gold badges84 silver badges134 bronze badges

Collectives™ on Stack Overflow

Print valid, non-escaped JSON in a view with Rails

4 Answers 4

2 Comments

Comments

4 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

Comments

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related