{"action":"closed","issue":{"url":"https://api.github.com/repos/facebook/immutable-js/issues/882","repository_url":"https://api.github.com/repos/facebook/immutable-js","labels_url":"https://api.github.com/repos/facebook/immutable-js/issues/882/labels{/name}","comments_url":"https://api.github.com/repos/facebook/immutable-js/issues/882/comments","events_url":"https://api.github.com/repos/facebook/immutable-js/issues/882/events","html_url":"https://github.com/facebook/immutable-js/issues/882","id":156809098,"number":882,"title":"fromJS doesn't sanitize","user":{"login":"marsch","id":179281,"avatar_url":"https://avatars.githubusercontent.com/u/179281?v=3","gravatar_id":"","url":"https://api.github.com/users/marsch","html_url":"https://github.com/marsch","followers_url":"https://api.github.com/users/marsch/followers","following_url":"https://api.github.com/users/marsch/following{/other_user}","gists_url":"https://api.github.com/users/marsch/gists{/gist_id}","starred_url":"https://api.github.com/users/marsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marsch/subscriptions","organizations_url":"https://api.github.com/users/marsch/orgs","repos_url":"https://api.github.com/users/marsch/repos","events_url":"https://api.github.com/users/marsch/events{/privacy}","received_events_url":"https://api.github.com/users/marsch/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-25T17:40:41Z","updated_at":"2016-05-25T17:51:53Z","closed_at":"2016-05-25T17:51:53Z","body":"### What happened\r\n\r\nAm not sure if this is a bug or an intended behavoir. But it happened to us, as where where using `immutablejs@3.8.1`. It happened that the user entered data with a `<script>`-tag. As usual we escaped it, but somehow, as we proceed with `.fromJS` it causes a leak.\r\n\r\n### How to reproduce\r\njust try to execute this\r\n```\r\nlet xxx = {  \r\n   \"opengraph\":{  \r\n      \"appId\":\"<!-- Facebook Pixel Code --> <script> !function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod? n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n; n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0; t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window, document,'script','https://connect.facebook.net/en_US/fbevents.js');  fbq('init', 'xxxxxxxx'); fbq('track', \\\\\\\"PageView\\\\\\\");</script> <noscript><img height=\\\\\\\"1\\\\\\\" width=\\\\\\\"1\\\\\\\" style=\\\\\\\"display:none\\\\\\\" src=\\\\\\\"https://www.facebook.com/tr?id=xxxxxxxx&ev=PageView&noscript=1\\\\\\\" /></noscript> <!-- End Facebook Pixel Code -->\"\r\n   }\r\n}\r\n\r\nImmutable.fromJS(xxx)\r\n```\r\n\r\nor go to: http://codepen.io/marsch/pen/gMYWMM"}}
{"actor":{"display_login":"marsch"}}