{"action":"opened","issue":{"url":"https://api.github.com/repos/JakobKallin/Excess-XSS/issues/4","repository_url":"https://api.github.com/repos/JakobKallin/Excess-XSS","labels_url":"https://api.github.com/repos/JakobKallin/Excess-XSS/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/JakobKallin/Excess-XSS/issues/4/comments","events_url":"https://api.github.com/repos/JakobKallin/Excess-XSS/issues/4/events","html_url":"https://github.com/JakobKallin/Excess-XSS/issues/4","id":142308465,"number":4,"title":"Some thoughts on encoding section","user":{"login":"zerkms","id":302295,"avatar_url":"https://avatars.githubusercontent.com/u/302295?v=3","gravatar_id":"","url":"https://api.github.com/users/zerkms","html_url":"https://github.com/zerkms","followers_url":"https://api.github.com/users/zerkms/followers","following_url":"https://api.github.com/users/zerkms/following{/other_user}","gists_url":"https://api.github.com/users/zerkms/gists{/gist_id}","starred_url":"https://api.github.com/users/zerkms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zerkms/subscriptions","organizations_url":"https://api.github.com/users/zerkms/orgs","repos_url":"https://api.github.com/users/zerkms/repos","events_url":"https://api.github.com/users/zerkms/events{/privacy}","received_events_url":"https://api.github.com/users/zerkms/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-21T10:28:16Z","updated_at":"2016-03-21T10:28:16Z","closed_at":null,"body":"It states that:\r\n\r\n> there are several built-in methods and properties that automatically encode all data in a context-aware manner:\r\n\r\nand uses\r\n\r\n```js\r\nelement.setAttribute(attribute, userInput)\r\n```\r\n\r\nas an example.\r\n\r\nWhile that is not true: encoding is necessary to prevent AST transformation of an HTML, that is a kind of seriailsed DOM.\r\n\r\nDue to that DOM itself is not affected to the XSS, so it may accept anything and should not do any extra encoding, since what you're passing is already treated as a parameter value and cannot mutate the tree.\r\n\r\nThoughts?"}}