[rejected AI] tojson: escape U+2028 and U+2029 (JavaScript line/paragraph separators)

[IMGillusion]

Problem

htmlsafe_json_dumps (the |tojson filter) escapes <, >, & and ' so its output is safe to embed in HTML and <script> tags. It does not escape the Unicode line separator U+2028 and paragraph separator U+2029.

JavaScript treats those two characters as line terminators, exactly like \n. When json.dumps is told to emit raw Unicode (ensure_ascii=False, a very common config), the separators are emitted unescaped, so a crafted string can break out of a <script> block:

env.policies['json.dumps_kwargs'] = {'ensure_ascii': False}
template = "{{ x|tojson }}"
# x = '""; alert(1); //\u2028document.location = \"http://evil\"'

Fix

Escape U+2028 / U+2029 to \\u2028 / \\u2029, matching what Django's json_script filter does. On the default path (ensure_ascii=True) json.dumps already escapes them as non-ASCII, so the new .replace() calls are harmless no-ops there.

Closes #1882

[davidism]

https://palletsprojects.com/contributing/llm-ai