provide a feature to protect against remote "script src" inclusion of Gson output about gson HOT 7 CLOSED

it would be great to have some central way of enabling it for all GSON objects 
in a
given app

instead of while(1); can we use the following prefix:
)]}'
<data>

please notice the newline character after '

thanks!

This is a great feature request.  Thanks for the suggestion.

I have added this to our roadmap for version 1.2.1 which is slotted for early 
October.

Hi Joel, i was wondering what's the status with this?

Fixed in r397 by supporting a new GsonBuilder setting 
generateNonExecutableJson()
that prefixes the generated JSON with some )]}'\n<data> to make the output
non-executable javascript. Gson now recognizes this special text in the input 
while
parsing the JSON in fromJson and filters it out, if present.

Is there a reason the NON_EXECUTABLE_PREFIX wasn't made configurable? I just 
submitted a request for it to be made configurable. 
https://code.google.com/p/google-gson/issues/detail?id=551