Make tojson always safe (fix #709)

CHANGES

@@ -1,6 +1,16 @@
 Jinja2 Changelog
 ================
 
+Version 2.9.7
+-------------
+
+(bugfix release, in development)
+
+- ``tojson`` filter marks output as safe to match documented behavior.
+  (`#718`_)
+
+.. _#718: https://github.com/pallets/jinja/pull/718
+
 Version 2.9.6
 -------------
 (bugfix release, released on April 3rd 2017)

jinja2/utils.py

@@ -567,7 +567,7 @@ def htmlsafe_json_dumps(obj, dumper=None, **kwargs):
         .replace(u'>', u'\\u003e') \
         .replace(u'&', u'\\u0026') \
         .replace(u"'", u'\\u0027')
-    return rv
+    return Markup(rv)
 
 
 @implements_iterator

tests/test_filters.py

@@ -580,8 +580,9 @@ def __init__(self, id, name):
     def test_json_dump(self):
         env = Environment(autoescape=True)
         t = env.from_string('{{ x|tojson }}')
-        assert t.render(x={'foo': 'bar'}) == '{"foo": "bar"}'
-        assert t.render(x='"bar\'') == r'"\"bar\u0027"'
+        assert t.render(x={'foo': 'bar'}) == '{"foo": "bar"}'
+        assert t.render(x='"ba&r\'') == r'"\"ba\u0026r\u0027"'
+        assert t.render(x='<bar>') == r'"\u003cbar\u003e"'
 
         def my_dumps(value, **options):
             assert options == {'foo': 'bar'}