{"action":"created","issue":{"url":"https://api.github.com/repos/ampproject/amphtml/issues/6201","repository_url":"https://api.github.com/repos/ampproject/amphtml","labels_url":"https://api.github.com/repos/ampproject/amphtml/issues/6201/labels{/name}","comments_url":"https://api.github.com/repos/ampproject/amphtml/issues/6201/comments","events_url":"https://api.github.com/repos/ampproject/amphtml/issues/6201/events","html_url":"https://github.com/ampproject/amphtml/pull/6201","id":189486660,"number":6201,"title":"Bind expressions","user":{"login":"choumx","id":20525523,"avatar_url":"https://avatars.githubusercontent.com/u/20525523?v=3","gravatar_id":"","url":"https://api.github.com/users/choumx","html_url":"https://github.com/choumx","followers_url":"https://api.github.com/users/choumx/followers","following_url":"https://api.github.com/users/choumx/following{/other_user}","gists_url":"https://api.github.com/users/choumx/gists{/gist_id}","starred_url":"https://api.github.com/users/choumx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/choumx/subscriptions","organizations_url":"https://api.github.com/users/choumx/orgs","repos_url":"https://api.github.com/users/choumx/repos","events_url":"https://api.github.com/users/choumx/events{/privacy}","received_events_url":"https://api.github.com/users/choumx/received_events","type":"User","site_admin":false},"labels":[{"id":261825898,"url":"https://api.github.com/repos/ampproject/amphtml/labels/NEEDS%20REVIEW","name":"NEEDS REVIEW","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":{"login":"dvoytenko","id":726049,"avatar_url":"https://avatars.githubusercontent.com/u/726049?v=3","gravatar_id":"","url":"https://api.github.com/users/dvoytenko","html_url":"https://github.com/dvoytenko","followers_url":"https://api.github.com/users/dvoytenko/followers","following_url":"https://api.github.com/users/dvoytenko/following{/other_user}","gists_url":"https://api.github.com/users/dvoytenko/gists{/gist_id}","starred_url":"https://api.github.com/users/dvoytenko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dvoytenko/subscriptions","organizations_url":"https://api.github.com/users/dvoytenko/orgs","repos_url":"https://api.github.com/users/dvoytenko/repos","events_url":"https://api.github.com/users/dvoytenko/events{/privacy}","received_events_url":"https://api.github.com/users/dvoytenko/received_events","type":"User","site_admin":false},"assignees":[{"login":"dvoytenko","id":726049,"avatar_url":"https://avatars.githubusercontent.com/u/726049?v=3","gravatar_id":"","url":"https://api.github.com/users/dvoytenko","html_url":"https://github.com/dvoytenko","followers_url":"https://api.github.com/users/dvoytenko/followers","following_url":"https://api.github.com/users/dvoytenko/following{/other_user}","gists_url":"https://api.github.com/users/dvoytenko/gists{/gist_id}","starred_url":"https://api.github.com/users/dvoytenko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dvoytenko/subscriptions","organizations_url":"https://api.github.com/users/dvoytenko/orgs","repos_url":"https://api.github.com/users/dvoytenko/repos","events_url":"https://api.github.com/users/dvoytenko/events{/privacy}","received_events_url":"https://api.github.com/users/dvoytenko/received_events","type":"User","site_admin":false},{"login":"aghassemi","id":2099009,"avatar_url":"https://avatars.githubusercontent.com/u/2099009?v=3","gravatar_id":"","url":"https://api.github.com/users/aghassemi","html_url":"https://github.com/aghassemi","followers_url":"https://api.github.com/users/aghassemi/followers","following_url":"https://api.github.com/users/aghassemi/following{/other_user}","gists_url":"https://api.github.com/users/aghassemi/gists{/gist_id}","starred_url":"https://api.github.com/users/aghassemi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aghassemi/subscriptions","organizations_url":"https://api.github.com/users/aghassemi/orgs","repos_url":"https://api.github.com/users/aghassemi/repos","events_url":"https://api.github.com/users/aghassemi/events{/privacy}","received_events_url":"https://api.github.com/users/aghassemi/received_events","type":"User","site_admin":false}],"milestone":null,"comments":8,"created_at":"2016-11-15T19:41:47Z","updated_at":"2016-11-30T01:20:30Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/ampproject/amphtml/pulls/6201","html_url":"https://github.com/ampproject/amphtml/pull/6201","diff_url":"https://github.com/ampproject/amphtml/pull/6201.diff","patch_url":"https://github.com/ampproject/amphtml/pull/6201.patch"},"body":"Partial for #6199.\r\n\r\nImplements Bind's JS-like expression grammar with Jison (also used by amp-access) and unit tests. Contains several security features, including:\r\n- Disallow access of prototype properties\r\n- Only allow invocation of whitelisted `String` and `Array` functions\r\n- Disallow access to globals, function declaration and non-whitelisted keywords\r\n\r\nOther things to note:\r\n- Undefined vars, properties, array-index-out-of-bounds return null instead of throwing errors (similar to Angular)\r\n- `bind-expr-impl.js` is just a compilation of `bind-expr-impl.jison` and can be ignored\r\n\r\n/to @dvoytenko @aghassemi\r\n/cc @cramforce"},"comment":{"url":"https://api.github.com/repos/ampproject/amphtml/issues/comments/263754067","html_url":"https://github.com/ampproject/amphtml/pull/6201#issuecomment-263754067","issue_url":"https://api.github.com/repos/ampproject/amphtml/issues/6201","id":263754067,"user":{"login":"cramforce","id":89679,"avatar_url":"https://avatars.githubusercontent.com/u/89679?v=3","gravatar_id":"","url":"https://api.github.com/users/cramforce","html_url":"https://github.com/cramforce","followers_url":"https://api.github.com/users/cramforce/followers","following_url":"https://api.github.com/users/cramforce/following{/other_user}","gists_url":"https://api.github.com/users/cramforce/gists{/gist_id}","starred_url":"https://api.github.com/users/cramforce/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cramforce/subscriptions","organizations_url":"https://api.github.com/users/cramforce/orgs","repos_url":"https://api.github.com/users/cramforce/repos","events_url":"https://api.github.com/users/cramforce/events{/privacy}","received_events_url":"https://api.github.com/users/cramforce/received_events","type":"User","site_admin":false},"created_at":"2016-11-30T01:20:30Z","updated_at":"2016-11-30T01:20:30Z","body":"Good for us we have Justin on our side :) Lets also test them.\n\nOn Tue, Nov 29, 2016 at 3:33 PM, Justin Ridgewell <notifications@github.com>\nwrote:\n\n> *@jridgewell* commented on this pull request.\n> ------------------------------\n>\n> In extensions/amp-bind/0.1/bind-expr-impl.jison\n> <https://github.com/ampproject/amphtml/pull/6201#pullrequestreview-10663650>\n> :\n>\n> >  // For security reasons, must not contain functions that mutate the caller.\n>  var functionWhitelist =\n>  {\n>    '[object Array]':\n> -    [\n> -      Array.prototype.concat,\n> -      Array.prototype.includes,\n> -      Array.prototype.indexOf,\n> -      Array.prototype.join,\n> -      Array.prototype.lastIndexOf,\n> -      Array.prototype.slice,\n> -    ],\n> +    {\n>\n> These must be prototype-less objects. As is, you've just allowed\n> __defineGetter__, __defineSetter__, hasOwnProperty, isPrototypeOf, etc.\n>\n> —\n> You are receiving this because you were mentioned.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/ampproject/amphtml/pull/6201#pullrequestreview-10663650>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AAFeT9PPVu1k8FKv_HpGI0NezmCdPLuFks5rDLZLgaJpZM4Ky76Y>\n> .\n>\n"}}
{"actor":{"display_login":"cramforce"}}