javascript - rails 3 escaped html tags unescaped in browser when served as JSON -

i have rails 3.2 app interacts 3rd party xml api data using activeresource. want ensure against xss in 3rd party xml, have enabled:

activesupport.escape_html_entities_in_json = true  

this seems work in xml data , converts < tag in potentially dangerous script call < this:

<script>alert('xss')</script> 

(not sure why esacpes lt tbh, seems design)

problem when convert xml json & send browser, browser sees unescaped. string in json sent browser looks this:

\u003cscript\u003ealert('xss')\u003c/script\u003e" 

can explain why browser converts unescaped string, , suggest workarounds?

fwiw i'm using backbone, jquery, jst & ejs

if string sent browser 1 in question, it's not browser converting back, it's sent unescaped. however, don't think server needs encode it, it's data, sent in intermediary data format json. is correctly encoded json. have careful when insert dom on client though.

in template, make sure use <%- instead of <%= , should fine unless generating javascript code of sort, that's edge case.

you can choose encode in response asked, in case should how it's converted xml json. aware though, different contexts may need different encodings (especially encoding requirements writing plain html vs in javascript context different), , server sending data may not (want to) know client wants it.