# XSS due to incomplete JS escaping

Rails' `j` JS-escape helper fails to escape backticks and `${}` in template literals, letting injected view data break out and execute script.

- Payout: hidden
- Severity: low
- Program: Ruby on Rails
- Found by: jessecampos
- Disclosed: 2020-05-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/474262
- Library page: https://bugbountylibrary.com/r/h1%3A474262
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:ruby technique:source-review vuln:xss

**Target:** ActionView::Helpers::JavaScriptHelper (javascript_helper.rb)
**Root cause:** The `j`/`escape_javascript` helper escapes quotes and newlines but not backticks or `${...}` interpolation, so values placed inside JS template literals can break out or inject expressions.
**Steps:**
1. Create a view containing `<script>let a = `<%= j '`+alert`' %>`</script>`
2. Observe alert executes because backticks are not escaped
3. Alternatively use `<script>let a = `<%= j '${alert()}' %>`</script>`
4. Observe alert executes because `${expression}` is not escaped; escaping `$` as `\$` mitigates
**How found:** Code review of the JS escaping helper, noticing template literal syntax (backticks, `${}`) is not in the escape set.
**Exploitation:** Attacker-controlled data rendered through `j` inside a template literal injects a backtick breakout or `${...}` expression, executing arbitrary JS in the victim's browser.
**Insight:** When auditing JS-context escapers, check every string delimiter the target language supports—template literals add backtick and `${}` injection surfaces that quote/newline escaping misses.