OJ is not as safe as you think for your JSON

OJ speeds up JSON in Ruby, but Oj.mimic_JSON silently drops the script_safe option, opening the door to XSS, and adds time precision quirks. What its monkey patching really changes, the stability risks, and best practices for using OJ without surprises.

Feb 3, 2025