to_json should be html_safe!

[ghazel]

<% javascript_tag do %>
  var foo = <%= "foo".to_json %>;
<% end %>

produces:

var foo = "foo";

in the javascript tag.

I believe all json is html safe, no? json escapes: '&' => '\u0026', '>' => '\u003E', '<' => '\u003C'. Although I suppose there should be .json_safe? etc, just marking it as html_safe! would avoid this bug.

[NZKoz]

This is a mixing of concerns / an MVC violation, the strings returned by to_json shouldn't know anything about the existence of the rails_xss output buffers or how they work.

If you want this to work you'll have to do:

<% javascript_tag do %>
  var foo = <%= raw "foo".to_json %>;
<% end %>

[NZKoz]

This is expected behaviour