{"action":"created","issue":{"url":"https://api.github.com/repos/bos/aeson/issues/180","labels_url":"https://api.github.com/repos/bos/aeson/issues/180/labels{/name}","comments_url":"https://api.github.com/repos/bos/aeson/issues/180/comments","events_url":"https://api.github.com/repos/bos/aeson/issues/180/events","html_url":"https://github.com/bos/aeson/issues/180","id":26506087,"number":180,"title":"Consider adding back escaping of '<' and '>' to prevent XSS injection","user":{"login":"meiersi","id":224829,"avatar_url":"https://avatars.githubusercontent.com/u/224829?v=3","gravatar_id":"","url":"https://api.github.com/users/meiersi","html_url":"https://github.com/meiersi","followers_url":"https://api.github.com/users/meiersi/followers","following_url":"https://api.github.com/users/meiersi/following{/other_user}","gists_url":"https://api.github.com/users/meiersi/gists{/gist_id}","starred_url":"https://api.github.com/users/meiersi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/meiersi/subscriptions","organizations_url":"https://api.github.com/users/meiersi/orgs","repos_url":"https://api.github.com/users/meiersi/repos","events_url":"https://api.github.com/users/meiersi/events{/privacy}","received_events_url":"https://api.github.com/users/meiersi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2014-01-29T08:58:40Z","updated_at":"2015-03-10T20:11:08Z","closed_at":null,"body":"I've just noticed that aeson-6.2.1 also escaped '<' and '>' characters (see for example https://github.com/bos/aeson/blob/6bae92494c1aeae4befdf2a87e5d9cd026b40e8b/Data/Aeson/Encode.hs#L79).\r\n\r\nThe new encoder does not do that. @bos, should I re-add the behaviour? When exactly is this escaping preventing an XSS injection? Note that in terms of encoding size this escaping is quite costly  when embedding HTML documents in JS strings. So, I'd like to understand why it is needed. I also suspect that it would be sufficient to only escape '<', as then it would be impossible to start a tag."},"comment":{"url":"https://api.github.com/repos/bos/aeson/issues/comments/78137420","html_url":"https://github.com/bos/aeson/issues/180#issuecomment-78137420","issue_url":"https://api.github.com/repos/bos/aeson/issues/180","id":78137420,"user":{"login":"avieth","id":1420272,"avatar_url":"https://avatars.githubusercontent.com/u/1420272?v=3","gravatar_id":"","url":"https://api.github.com/users/avieth","html_url":"https://github.com/avieth","followers_url":"https://api.github.com/users/avieth/followers","following_url":"https://api.github.com/users/avieth/following{/other_user}","gists_url":"https://api.github.com/users/avieth/gists{/gist_id}","starred_url":"https://api.github.com/users/avieth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/avieth/subscriptions","organizations_url":"https://api.github.com/users/avieth/orgs","repos_url":"https://api.github.com/users/avieth/repos","events_url":"https://api.github.com/users/avieth/events{/privacy}","received_events_url":"https://api.github.com/users/avieth/received_events","type":"User","site_admin":false},"created_at":"2015-03-10T20:11:08Z","updated_at":"2015-03-10T20:11:08Z","body":"+1 for *not* escaping these, because there are applications which demand human-readable JSON. For instance, programmatically building or altering a node.js package.json file. It's not a huge cost: the package.json file will be interpreted correctly even with the `<, >` characters escaped, but it will be *slightly-less* readable.\r\n"}}