{"action":"created","issue":{"url":"https://api.github.com/repos/ariya/phantomjs/issues/14144","repository_url":"https://api.github.com/repos/ariya/phantomjs","labels_url":"https://api.github.com/repos/ariya/phantomjs/issues/14144/labels{/name}","comments_url":"https://api.github.com/repos/ariya/phantomjs/issues/14144/comments","events_url":"https://api.github.com/repos/ariya/phantomjs/issues/14144/events","html_url":"https://github.com/ariya/phantomjs/issues/14144","id":143998766,"number":14144,"title":"web-security and security issue.","user":{"login":"Losiara","id":5796819,"avatar_url":"https://avatars.githubusercontent.com/u/5796819?v=3","gravatar_id":"","url":"https://api.github.com/users/Losiara","html_url":"https://github.com/Losiara","followers_url":"https://api.github.com/users/Losiara/followers","following_url":"https://api.github.com/users/Losiara/following{/other_user}","gists_url":"https://api.github.com/users/Losiara/gists{/gist_id}","starred_url":"https://api.github.com/users/Losiara/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Losiara/subscriptions","organizations_url":"https://api.github.com/users/Losiara/orgs","repos_url":"https://api.github.com/users/Losiara/repos","events_url":"https://api.github.com/users/Losiara/events{/privacy}","received_events_url":"https://api.github.com/users/Losiara/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-28T15:09:36Z","updated_at":"2016-03-29T01:34:32Z","closed_at":null,"body":"How \"danger\" is web-security=false?\r\n\r\nIf I get a cross-domain iframe with script which \"accesses\" to my fs, is it possible to corrupt it by some command or downloaded scripts can't access to file system even if web-security set to no."},"comment":{"url":"https://api.github.com/repos/ariya/phantomjs/issues/comments/202656914","html_url":"https://github.com/ariya/phantomjs/issues/14144#issuecomment-202656914","issue_url":"https://api.github.com/repos/ariya/phantomjs/issues/14144","id":202656914,"user":{"login":"firedfox","id":171705,"avatar_url":"https://avatars.githubusercontent.com/u/171705?v=3","gravatar_id":"","url":"https://api.github.com/users/firedfox","html_url":"https://github.com/firedfox","followers_url":"https://api.github.com/users/firedfox/followers","following_url":"https://api.github.com/users/firedfox/following{/other_user}","gists_url":"https://api.github.com/users/firedfox/gists{/gist_id}","starred_url":"https://api.github.com/users/firedfox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/firedfox/subscriptions","organizations_url":"https://api.github.com/users/firedfox/orgs","repos_url":"https://api.github.com/users/firedfox/repos","events_url":"https://api.github.com/users/firedfox/events{/privacy}","received_events_url":"https://api.github.com/users/firedfox/received_events","type":"User","site_admin":false},"created_at":"2016-03-29T01:34:32Z","updated_at":"2016-03-29T01:34:32Z","body":"it's not dangerous for your local server. it only disables some restricts, such as allowing cross-domain XMLHttpRequest calls, and so on."}}