Escape HTML in JSON output by default, to prevent potential XSS.

Author: Daniel15

build.proj

@@ -11,7 +11,7 @@ of patent rights can be found in the PATENTS file in the same directory.
 	<PropertyGroup>
 		<Major>1</Major>
 		<Minor>5</Minor>
-		<Build>0</Build>
+		<Build>1</Build>
 		<Revision>0</Revision>
 		<DevNuGetServer>http://reactjs.net/packages/</DevNuGetServer>
 		<MSBuildCommunityTasksPath>$(MSBuildProjectDirectory)\tools\MSBuildTasks</MSBuildCommunityTasksPath>

src/React.AspNet/project.json

@@ -1,5 +1,5 @@
 {
-    "version": "1.5.0-*",
+    "version": "1.5.1-*",
     "configurations": {
         "Debug": {
             "compilationOptions": {

src/React.Core/ReactSiteConfiguration.cs

@@ -9,7 +9,6 @@
 
 using Newtonsoft.Json;
 using System.Collections.Generic;
-using System.Collections.ObjectModel;
 using System.Linq;
 
 namespace React
@@ -38,6 +37,10 @@ public ReactSiteConfiguration()
 			ReuseJavaScriptEngines = true;
 			AllowMsieEngine = true;
 			LoadReact = true;
+			JsonSerializerSettings = new JsonSerializerSettings
+			{
+				StringEscapeHandling = StringEscapeHandling.EscapeHtml
+			};
 		}
 
 		/// <summary>

src/React.Sample.Mvc6/project.json

@@ -1,7 +1,7 @@
 {
     /* Click to learn more about project.json  http://go.microsoft.com/fwlink/?LinkID=517074 */
     "webroot": "wwwroot",
-    "version": "1.5.0-*",
+    "version": "1.5.1-*",
     "dependencies": {
         "Microsoft.AspNet.Mvc": "6.0.0.0-beta3",
         "Microsoft.AspNet.Diagnostics": "1.0.0.0-beta3",

src/wrap/React.Core/project.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.5.0-*",
+  "version": "1.5.1-*",
   "frameworks": {
     "net40": {
       "wrappedProject": "../../React.Core/React.Core.csproj",

src/wrap/React/project.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.5.0-*",
+  "version": "1.5.1-*",
   "frameworks": {
     "net40": {
       "wrappedProject": "../../React.Core/React.Core.csproj",

src/wrap/VroomJs/project.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.5.0-*",
+  "version": "1.5.1-*",
   "frameworks": {
     "net40": {
       "bin": {