Doesn't escape HTML entities

[spankykopita]

jsonTree.js will print out HTML content to the page as is rather than escaping the HTML entities. This results in the HTML being inserted into the DOM and presented, and allows some types of custom Javascript execution. This constitutes an XSS vulnerability for any pages that render user-provided JSON using this library.

For example, on your demo page at http://summerstyle.github.io/jsonTreeViewer/ - provide the input {"test":"<img src='x' onerror='alert(1)'>"} and observe the alert.

[Heath123]

Is this abandoned? This is quite a serious problem that needs fixing

[KraXen72]

just .replaceAll() the < and > for their respective html entities in your code before parsing

[Heath123]

just .replaceAll() the < and > for their respective html entities in your code before parsing

Well it's better to use a proper HTML escaper like https://www.npmjs.com/package/escape-html