CVE-2014-3994

@@ -5,13 +5,17 @@ version 0.8.3 (6-June-2014):
 		  Users could construct a name that would allow for injecting
 		  JavaScript in the page. That name is now properly escaped.
 
+		  This is CVE-2014-3995.
+
 		* Fixed a XSS issue in json_dumps.
 
 		  JSON payloads constructed based on user input and then injected into
 		  a page could result in custom JavaScript being injected into the
 		  page. Additional escaping is now performed to ensure this does not
 		  happen.
 
+		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
+
 
 version 0.8.2 (2-June-2014):
 	* Packaging:

@@ -5,13 +5,17 @@ version 0.7.30 final (6-June-2014):
 		  Users could construct a name that would allow for injecting
 		  JavaScript in the page. That name is now properly escaped.
 
+		  This is CVE-2014-3995.
+
 		* Fixed a XSS issue in json_dumps.
 
 		  JSON payloads constructed based on user input and then injected into
 		  a page could result in custom JavaScript being injected into the
 		  page. Additional escaping is now performed to ensure this does not
 		  happen.
 
+		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
+
 
 version 0.7.29 final (9-April-2014):
 	* djblets.webapi:

@@ -31,13 +31,20 @@
 from django.core.serializers import serialize
 from django.db.models.query import QuerySet
 from django.utils import six
+from django.utils.encoding import force_text
 from django.utils.safestring import mark_safe
 
 from djblets.util.serializers import DjbletsJSONEncoder
 
 
 register = template.Library()
 
+_safe_js_escapes = {
+    ord('&'): '\\u0026',
+    ord('<'): '\\u003C',
+    ord('>'): '\\u003E',
+}
+
 
 @register.simple_tag
 def form_dialog_fields(form):
@@ -75,7 +82,7 @@ def json_dumps(value, indent=None):
     else:
         result = json.dumps(value, indent=indent, cls=DjbletsJSONEncoder)
 
-    return mark_safe(result)
+    return mark_safe(force_text(result).translate(_safe_js_escapes))
 
 
 @register.filter

@@ -0,0 +1,19 @@
+from __future__ import unicode_literals
+
+from djblets.testing.testcases import TestCase
+from djblets.util.templatetags.djblets_js import json_dumps
+
+
+class JSTagTests(TestCase):
+    """Unit tests for djblets_js template tags."""
+    def test_json_dumps_xss(self):
+        """Testing json_dumps doesn't allow XSS injection"""
+        # This is bug 3406.
+        obj = {
+            'xss': '</script><script>alert(1);</script>'
+        }
+
+        self.assertEqual(
+            json_dumps(obj),
+            '{"xss": "\\u003C/script\\u003E\\u003Cscript\\u003E'
+            'alert(1);\\u003C/script\\u003E"}')