props-json potential security risk?

[rybon]

Perhaps point users towards https://github.com/yahoo/serialize-javascript just to be careful?

[rstacruz]

Thanks for the report, and your contributions!

Hmm, serialize-javascript seems like it might make things even worse by allowing more things in other than Objects and Arrays. Can you explain more?

[rybon]

If users serialize arbitrary JSON to use in props-json, that might pose a security risk. serialize-javascript is basically an enhanced JSON.stringify that automatically escapes potentially unsafe values to prevent XSS. We could add it as a suggestion to the docs.