@@ -76,8 +76,6 @@ string s = {-# SCC "string" #-} singleton '"' <> quote s <> singleton '"'
7676 where (h,t) = {-# SCC "break" #-} T.break isEscape q
7777 isEscape c = c == '\"' ||
7878 c == '\\' ||
79− c == '<' ||
80− c == '>' ||
8179 c < '\x20'
8280 escape '\"' = "\\\""
8381 escape '\\' = "\\\\"
@@ -85,11 +83,6 @@ string s = {-# SCC "string" #-} singleton '"' <> quote s <> singleton '"'
8583 escape '\r' = "\\r"
8684 escape '\t' = "\\t"
8785
88− -- The following prevents untrusted JSON strings containing </script> or -->
89− -- from causing an XSS vulnerability:
90− escape '<' = "\\u003c"
91− escape '>' = "\\u003e"
92−
9386 escape c
9487 | c < '\x20' = fromString $ "\\u" ++ replicate (4 - length h) '0' ++ h
9588 | otherwise = singleton c