Fix XSS injection issues

CHANGELOG.md

@@ -10,4 +10,12 @@ Please follow the recommendations outlined at [keepachangelog.com](https://keepa
 
 ## [Unreleased]
 
+### [0.0.2]
+#### Fixed
+- XSS injection issues [PR 5](https://github.com/shakacode/jstreamer/pull/5)
+
+#### Improved
+- docs formatting and typos [PR 4](https://github.com/shakacode/jstreamer/pull/4)
+
+### [0.0.1]
 - Initial release

lib/jstreamer.rb

@@ -87,6 +87,6 @@ def generate(template, object = nil, **options)
   # Creates new stream (low-level engine)
   # @return stream low-level engine
   def create_new_stream
-    Oj::StringWriter.new
+    Oj::StringWriter.new(escape_mode: :xss_safe)
   end
 end

spec/jstreamer_spec.rb

@@ -29,5 +29,23 @@ def render
     it "retruns stream" do
       expect(described_class.create_new_stream).not_to be_nil
     end
+
+    it "handles Unicode XSS injections" do
+      stream = described_class.create_new_stream
+
+      stream.push_value("\u2028\u2029\u0000", "x")
+      result = stream.to_s.split(":").last
+
+      expect(result).to eq('"\\u2028\\u2029\\u0000"')
+    end
+
+    it "handles HTML XSS injections" do
+      stream = described_class.create_new_stream
+
+      stream.push_value("<>&", "x")
+      result = stream.to_s.split(":").last
+
+      expect(result).to eq('"\\u003c\\u003e\\u0026"')
+    end
   end
 end