v1.2.2

• Escape tab characters since some JSON parsers do not allow raw tabs in string literals
• Fixed bug: better handling for number literals that do not fit in 64 bits and numbers that look like C octal or hex literals.

v1.2.1

Users of com.mikesamuel:json-sanitizer should upgrade to version 1.2.1 or later.

A bug in com.mikesamuel:json-sanitizer:1.2.0 and prior allows an attacker who controls the content of a JSON string that is later embedded in an HTML <script> element to confuse the HTML parser as to where the <script> element ends. If the attacker also controls other content, e.g. a string of non-JavaScript content adjacent to the <script> element, this can lead to arbitrary JavaScript execution.

See #20 (comment) for details.

CVE-2020-13973

1.2.0

Site documentation update