{"action":"created","issue":{"url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/816","repository_url":"https://api.github.com/repos/dotnet/roslyn-analyzers","labels_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/816/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/816/comments","events_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/816/events","html_url":"https://github.com/dotnet/roslyn-analyzers/pull/816","id":128955970,"number":816,"title":"Add XML rules CA3076 Only","user":{"login":"qinxgit","id":13911400,"avatar_url":"https://avatars.githubusercontent.com/u/13911400?v=3","gravatar_id":"","url":"https://api.github.com/users/qinxgit","html_url":"https://github.com/qinxgit","followers_url":"https://api.github.com/users/qinxgit/followers","following_url":"https://api.github.com/users/qinxgit/following{/other_user}","gists_url":"https://api.github.com/users/qinxgit/gists{/gist_id}","starred_url":"https://api.github.com/users/qinxgit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qinxgit/subscriptions","organizations_url":"https://api.github.com/users/qinxgit/orgs","repos_url":"https://api.github.com/users/qinxgit/repos","events_url":"https://api.github.com/users/qinxgit/events{/privacy}","received_events_url":"https://api.github.com/users/qinxgit/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dotnet/roslyn-analyzers/labels/cla-already-signed","name":"cla-already-signed","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-26T22:00:40Z","updated_at":"2016-02-11T22:53:09Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/dotnet/roslyn-analyzers/pulls/816","html_url":"https://github.com/dotnet/roslyn-analyzers/pull/816","diff_url":"https://github.com/dotnet/roslyn-analyzers/pull/816.diff","patch_url":"https://github.com/dotnet/roslyn-analyzers/pull/816.patch"},"body":"Add security rules CA3076 about XSLT. The strings are finalized.\r\n\r\nIf you execute Extensible Stylesheets Language Transformations (XSLT) in .NET applications insecurely, the processor may resolve untrusted URI references that could disclose sensitive information to attackers, leading to Denial of Service and Cross-Site attacks.\r\n\r\nRule Description \r\nXSLT is a World Wide Web Consortium (W3C) standard for transforming XML data. XSLT is typically used to write style sheets to transform XML data to other formats such as HTML, fixed length text, comma-separated text, or a different XML format. Although prohibited by default, you may choose to enable it for your project. \r\n\r\nTo ensure you're not exposing an attack surface, this rule triggers whenever the XslCompiledTransform.Load receives insecure combination instances of XsltSettings and XmlResolver, which allows malicious script processing\r\n\r\n@genlu @srivatsn "},"comment":{"url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/comments/183091587","html_url":"https://github.com/dotnet/roslyn-analyzers/pull/816#issuecomment-183091587","issue_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/816","id":183091587,"user":{"login":"qinxgit","id":13911400,"avatar_url":"https://avatars.githubusercontent.com/u/13911400?v=3","gravatar_id":"","url":"https://api.github.com/users/qinxgit","html_url":"https://github.com/qinxgit","followers_url":"https://api.github.com/users/qinxgit/followers","following_url":"https://api.github.com/users/qinxgit/following{/other_user}","gists_url":"https://api.github.com/users/qinxgit/gists{/gist_id}","starred_url":"https://api.github.com/users/qinxgit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qinxgit/subscriptions","organizations_url":"https://api.github.com/users/qinxgit/orgs","repos_url":"https://api.github.com/users/qinxgit/repos","events_url":"https://api.github.com/users/qinxgit/events{/privacy}","received_events_url":"https://api.github.com/users/qinxgit/received_events","type":"User","site_admin":false},"created_at":"2016-02-11T22:53:09Z","updated_at":"2016-02-11T22:53:09Z","body":"@lgolding \r\nLet me know if there are more issues for me to fix. "}}