[5.5] Blade: Make @json directive safe for use in HTML

src/Illuminate/View/Compilers/Concerns/CompilesJson.php

@@ -4,6 +4,16 @@
 
 trait CompilesJson
 {
+    /**
+     * Default encoding options.
+     *
+     * To make JSON safe for embedding into HTML, <, >, ', &, and " characters
+     * should be escaped.
+     *
+     * @var int
+     */
+    private $safeEncodingOptions = JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_AMP | JSON_HEX_QUOT;
+
     /**
      * Compile the JSON statement into valid PHP.
      *
@@ -14,9 +24,8 @@ protected function compileJson($expression)
     {
         $parts = explode(',', $this->stripParentheses($expression));
 
-        $options = $parts[1] ?? 0;
-
-        $depth = $parts[2] ?? 512;
+        $options = trim($parts[1] ?? $this->safeEncodingOptions);
+        $depth = trim($parts[2] ?? 512);
 
         return "<?php echo json_encode($parts[0], $options, $depth) ?>";
     }

tests/View/Blade/BladeJsonTest.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Illuminate\Tests\View\Blade;
+
+class BladeJsonTest extends AbstractBladeTestCase
+{
+    public function testStatementIsCompiledWithSafeDefaultEncodingOptions()
+    {
+        $string = 'var foo = @json($var);';
+        $expected = 'var foo = <?php echo json_encode($var, 15, 512) ?>;';
+
+        $this->assertEquals($expected, $this->compiler->compileString($string));
+    }
+
+    public function testEncodingOptionsCanBeOverwritten()
+    {
+        $string = 'var foo = @json($var, JSON_HEX_TAG);';
+        $expected = 'var foo = <?php echo json_encode($var, JSON_HEX_TAG, 512) ?>;';
+
+        $this->assertEquals($expected, $this->compiler->compileString($string));
+    }
+}