Json.net escape html element special character in Json serialization [duplicate] - json.net

Question

Using Json.NET
JsonConvert.SerializeObject(new { Property = "<script>alert('o hai');</script>" })
returns
{"Property":"<script>alert('o hai');</script>"}
Is it possible for the value to be escaped by SerializeObject to prevent a hostile script from executing? I'd prefer not to make changes to the object itself.
Edit: Ideally I'd like to integrate the sanitizing into the SerializeObject call without having to process the object before or after SerializeObject.
Edit: The string output from JsonConvert.SerializeObject is assigned to a global variable in a script block, which I believe is where the XSS issue is.

Answer 1

Functionality to achieve this was added in version 4.5.11
This allows you to add various type of escaping to the output.
This is my LinqPad test:
var settings = new JsonSerializerSettings();
settings.StringEscapeHandling = StringEscapeHandling.EscapeHtml;
var output = JsonConvert.SerializeObject(new { Property = "<script>alert('o hai');</script>" }, settings);
Debug.Print(output);
outputs
{"Property":"\u003cscript\u003ealert(\u0027o hai\u0027);\u003c/script\u003e"}
Just as a disclaimer, this isn't a golden bullet to fix xss, but should help you mitigate it a bit given your example.

Answer 2

This may not be ideal but this is my solution (for now, at least):
JsonConvert.SerializeObject(new { Property = "<script>alert('o hai');</script>" }, new HtmlEncodeStringPropertiesConverter());
with a simple JsonConverter that performs HtmlEncode on the value if it is a string
public class HtmlEncodeStringPropertiesConverter : JsonConverter
{
public override bool CanConvert(Type objectType)
{
return objectType == typeof(string);
}
public override object ReadJson(JsonReader reader, Type objectType, object existingValue, JsonSerializer serializer)
{
throw new NotImplementedException();
}
public override void WriteJson(JsonWriter writer, object value, JsonSerializer serializer)
{
writer.WriteValue(Encoder.HtmlEncode(value.ToString()));
}
}
(Encoder is Microsoft.Security.Application.Encoder from the AntiXSS library)

Answer 3

In .NET Core 3.0, System.Text.Json.JsonSerializer escapes html characters by default.
var text = "<script>alert('o hai');</script>";
var json = System.Text.Json.JsonSerializer.Serialize(new { Property = text });
Console.WriteLine(json);
Output
// .NETCoreApp,Version=v3.0
{"Property":"\u003Cscript\u003Ealert(\u0027o hai\u0027);\u003C/script\u003E"}
Documentation
How to serialize and deserialize JSON in .NET in Serialization behavior section says:
The default encoder escapes non-ASCII characters, HTML-sensitive characters within the ASCII-range, and characters that must be escaped according to the JSON spec.
Please also check the remarks for JavaScriptEncoder.UnsafeRelaxedJsonEscaping because it contains a series of remarks starting with Unlike the Default.
I don't want to escape it
JavaScriptEncoder.UnsafeRelaxedJsonEscaping needs to be set to turn off the default behavior.
var options = new System.Text.Json.JsonSerializerOptions() {
Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping
};
var json2 = System.Text.Json.JsonSerializer.Serialize(new { Property = text }, options);
Console.WriteLine(json2);
{"Property":"<script>alert('o hai');</script>"}
UnsafeRelaxedJsonEscaping's Documentation
Remarks for UnsafeRelaxedJsonEscaping:
Unlike the Default encoder, this encoder instance does not escape HTML-sensitive characters such as <, >, &. As a result, it must be used cautiously; for example, it can be used if the output data is within a response whose content-type is known with a charset set to UTF-8.
Unlike the Default encoding, the quotation mark is encoded as " rather than \u0022.
Unlike the Default encoding (which only allows UnicodeRanges.BasicLatin), using this encoder instance allows UnicodeRanges.All to go through unescaped.
Unlike the Default encoder, this encoder instance allows some other characters (such as '+') to go through unescaped and therefore must be used cautiously.

Answer 4

No, JSON.NET is a JSON serializer. It is not a XSS sanitizer. You may take a look at the AntiXSS library from Microsoft. Here's an article on MSDN about its usage (a little outdated but still relevant).