diff options
Diffstat (limited to 'docs/ref/request-response.txt')
| -rw-r--r-- | docs/ref/request-response.txt | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/docs/ref/request-response.txt b/docs/ref/request-response.txt index 9595161671..b4bcc22122 100644 --- a/docs/ref/request-response.txt +++ b/docs/ref/request-response.txt @@ -1126,9 +1126,9 @@ Without passing ``safe=False``, a :exc:`TypeError` will be raised. .. warning:: Before the `5th edition of ECMAScript - <https://www.ecma-international.org/ecma-262/5.1/index.html#sec-11.1.4>`_ - it was possible to poison the JavaScript ``Array`` constructor. For this - reason, Django does not allow passing non-dict objects to the + <https://262.ecma-international.org/5.1/#sec-11.1.4>`_ it was possible to + poison the JavaScript ``Array`` constructor. For this reason, Django does + not allow passing non-dict objects to the :class:`~django.http.JsonResponse` constructor by default. However, most modern browsers implement EcmaScript 5 which removes this attack vector. Therefore it is possible to disable this security precaution. |