This rule is designed to ensure that HTML entities are escaped when they are included in JSON. Escaping HTML entities in JSON is important because it helps to prevent cross-site scripting (XSS) attacks. XSS attacks can allow attackers to inject malicious scripts into web pages viewed by other users, leading to a wide range of potential security issues.
The ActiveSupport.escape_html_entities_in_json configuration option in Ruby on Rails controls whether or not HTML entities are escaped in JSON. By default, this option is set to false. However, for better security, it should be set to true.
To avoid violating this rule, always set ActiveSupport.escape_html_entities_in_json = true in your Ruby on Rails applications. This will ensure that any HTML entities that are included in your JSON are properly escaped, helping to protect your application from potential XSS attacks.
Non-Compliant Code Examples
ActiveSupport.escape_html_entities_in_json=false
Compliant Code Examples
ActiveSupport.escape_html_entities_in_json=true
Seamless integrations. Try Datadog Code Analysis
Datadog Code Analysis
Try this rule and analyze your code with Datadog Code Analysis
How to use this rule
1
2
rulesets:- ruby-security # Rules to enforce Ruby security.
Create a static-analysis.datadog.yml with the content above at the root of your repository
Use our free IDE Plugins or add Code Analysis scans to your CI pipelines
