Fix json encode potential XSS when in script tags

[cdrini]

We often use <script>$:json_encode(...)</script> , but this is susceptible to XSS if the the object being JSON-stringified contains closing script tags, eg

<script>
    var x = $:json_encode({"description": "user input</script><script>alert('xss')</script>"});
</script>

Becomes:

<script>
    var x = {"description": "user input</script><script>alert('xss')</script>"};
</script>

Here we also replace < / > with \u003c and \u003e to prevent it being interpreted as a closing script tag:

<script>
    var x = {"description": "user input\u003c/script\u003e\u003cscript\u003ealert('xss')\u003c/script\u003e"};
</script>

Technical

DRY'd up our two implementation of json_encode so the fix would only need to happen in one spot.

Testing

Also tested by adding the above html sample to the status page locally, and confirmed it no longer XSS's.

Confirmed reading log stats, where we use this pattern, renders correctly.

Screenshot

Stakeholders