javascript - Why is simplejson encoder for html escaping with \\u0026 instead of & letting an XSS happen? -

i trying automatically html escape strings going json objects. simplejson has jsonencoderforhtml supposed that. how escapes html:

chunk = chunk.replace('&', '\\u0026') chunk = chunk.replace('<', '\\u003c') chunk = chunk.replace('>', '\\u003e') 

1) why using these codes instead of html encoding cgi.escape uses?

which is:

chunk = chunk.replace('&', '&amp;') chunk = chunk.replace('<', '&lt;') chunk = chunk.replace('>', '&gt;') 

each of them state:

simplejson: to embed json content in, say, script tag on web page, characters &, < , > should escaped. they cannot escaped usual entities (e.g. &) because not expanded within tags.

cgi.escape: replace special characters "&", "<" , ">" html-safe sequences.

2) part in bold mean here?

other not understanding differences here, core of problem simplejson method lets xss happen, if go in html encoder , change replace calls ones of cgi.escape, no xss.

given input {'label': 'xss here"><script>alert(1)</script>'}

here output simplejson.encoder.jsonencoderforhtml:

{"label": "xss here\"\u003e\u003cscript\u003ealert(1);\u003c/script\u003e"} 

here output simplejson.encoder.jsonencoderforhtml , changing codes in replace &, etc. indicated earlier:

{"label": "xss here\"><script>alert(1);</script>"} 

it used used autocompletion .js script (not between in html file) this:

return $('<a/>').attr('href', result.url)         .append($('<img>').attr('src', imageurl)             .addclass(image_class)             .after($('<span/>')             .addclass(label_class).text(result.label))); 

result.label value of key 'label'.

3) why javascript alert displaying 1 simplejson method, not cgi.escape escaping?

are codes \\u003c decoded , treated < characters?

to give more context, don't have in every json handler of web app , potentially forget escape something:

response = {'a': escape(a), 'b': escape(b)} # many more variables here return json.dumps(response) 

4) there alternative way of automatically escape html returned in json?

a recursive walk of object tornado.escape.recursive_unicode escaping instead? else?

update: alert, why 1 escape using method?

<div id="alert">a</div> $("#alert").html("xss here\"\u003e\u003cscript\u003ealert(1);\u003c/script\u003e"); 

http://jsfiddle.net/aclyd/

jsonencoderforhtml makes json safe embedding in <script> tag, not want , there's no reasonable way library.