jsonTreeViewer Doesn't escape HTML entities

jsonTree.js will print out HTML content to the page as is rather than escaping the HTML entities. This results in the HTML being inserted into the DOM and presented, and allows some types of custom Javascript execution. This constitutes an XSS vulnerability for any pages that render user-provided JSON using this library.

For example, on your demo page at http://summerstyle.github.io/jsonTreeViewer/ - provide the input {"test":"<img src='x' onerror='alert(1)'>"} and observe the alert.

Oct 02 '18 18:10 spankykopita

Is this abandoned? This is quite a serious problem that needs fixing

May 15 '20 09:05 Heath123

just .replaceAll() the < and > for their respective html entities in your code before parsing

Jan 02 '21 19:01 KraXen72

just .replaceAll() the < and > for their respective html entities in your code before parsing

Well it's better to use a proper HTML escaper like https://www.npmjs.com/package/escape-html

Jan 02 '21 20:01 Heath123