{"action":"created","issue":{"url":"https://api.github.com/repos/ausaccessfed/discovery-service/issues/66","repository_url":"https://api.github.com/repos/ausaccessfed/discovery-service","labels_url":"https://api.github.com/repos/ausaccessfed/discovery-service/issues/66/labels{/name}","comments_url":"https://api.github.com/repos/ausaccessfed/discovery-service/issues/66/comments","events_url":"https://api.github.com/repos/ausaccessfed/discovery-service/issues/66/events","html_url":"https://github.com/ausaccessfed/discovery-service/issues/66","id":144432008,"number":66,"title":"SP's with an Apostrophe in the name are displayed with &#39; ","user":{"login":"trsau","id":150069,"avatar_url":"https://avatars.githubusercontent.com/u/150069?v=3","gravatar_id":"","url":"https://api.github.com/users/trsau","html_url":"https://github.com/trsau","followers_url":"https://api.github.com/users/trsau/followers","following_url":"https://api.github.com/users/trsau/following{/other_user}","gists_url":"https://api.github.com/users/trsau/gists{/gist_id}","starred_url":"https://api.github.com/users/trsau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trsau/subscriptions","organizations_url":"https://api.github.com/users/trsau/orgs","repos_url":"https://api.github.com/users/trsau/repos","events_url":"https://api.github.com/users/trsau/events{/privacy}","received_events_url":"https://api.github.com/users/trsau/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ausaccessfed/discovery-service/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"bradleybeddoes","id":86558,"avatar_url":"https://avatars.githubusercontent.com/u/86558?v=3","gravatar_id":"","url":"https://api.github.com/users/bradleybeddoes","html_url":"https://github.com/bradleybeddoes","followers_url":"https://api.github.com/users/bradleybeddoes/followers","following_url":"https://api.github.com/users/bradleybeddoes/following{/other_user}","gists_url":"https://api.github.com/users/bradleybeddoes/gists{/gist_id}","starred_url":"https://api.github.com/users/bradleybeddoes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradleybeddoes/subscriptions","organizations_url":"https://api.github.com/users/bradleybeddoes/orgs","repos_url":"https://api.github.com/users/bradleybeddoes/repos","events_url":"https://api.github.com/users/bradleybeddoes/events{/privacy}","received_events_url":"https://api.github.com/users/bradleybeddoes/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2016-03-30T01:13:18Z","updated_at":"2016-03-31T01:03:58Z","closed_at":null,"body":"I have a Simple attribute reflector in test called \"TRS's Testing tool\" which appears on the DS page as \"Login to TRS&#39;s Testing tool\" with a description of \"TRS&#39;s Testing tool\"\r\n\r\nThe mdui entry for this SP in the new metadata feed has the apostrophe.\r\n\r\nI expect other special characters in SP's names and descriptions will have these characters transformed. "},"comment":{"url":"https://api.github.com/repos/ausaccessfed/discovery-service/issues/comments/203700865","html_url":"https://github.com/ausaccessfed/discovery-service/issues/66#issuecomment-203700865","issue_url":"https://api.github.com/repos/ausaccessfed/discovery-service/issues/66","id":203700865,"user":{"login":"bradleybeddoes","id":86558,"avatar_url":"https://avatars.githubusercontent.com/u/86558?v=3","gravatar_id":"","url":"https://api.github.com/users/bradleybeddoes","html_url":"https://github.com/bradleybeddoes","followers_url":"https://api.github.com/users/bradleybeddoes/followers","following_url":"https://api.github.com/users/bradleybeddoes/following{/other_user}","gists_url":"https://api.github.com/users/bradleybeddoes/gists{/gist_id}","starred_url":"https://api.github.com/users/bradleybeddoes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradleybeddoes/subscriptions","organizations_url":"https://api.github.com/users/bradleybeddoes/orgs","repos_url":"https://api.github.com/users/bradleybeddoes/repos","events_url":"https://api.github.com/users/bradleybeddoes/events{/privacy}","received_events_url":"https://api.github.com/users/bradleybeddoes/received_events","type":"User","site_admin":false},"created_at":"2016-03-31T01:03:58Z","updated_at":"2016-03-31T01:03:58Z","body":"Having dug through the code base and checked inputs / persistence etc I've determined that the problem lies at:\r\n\r\nhttps://github.com/ausaccessfed/discovery-service/blob/develop/assets/javascripts/application.js#L164\r\n\r\nThe view being incorrect is simply due to HTML encoded strings being passed verbatim to a JSON decode routine.\r\n\r\nThe solution for this needs to be XSS safe given we can't trust what comes via Metadata feeds. I've done some research on this and come up with the following JS (http://stackoverflow.com/a/1395954 is what really set me on the right path):\r\n\r\n```\r\nfunction decodeEntityList(encodedString) {\r\n    var textArea = document.createElement('textarea');\r\n    textArea.innerHTML = encodedString;\r\n    decodedString = textArea.value; \r\n    \r\n    if ('remove' in Element.prototype) \r\n        textArea.remove();\r\n\r\n    return decodedString;\r\n}\r\n```\r\n\r\nI'll be addressing this in code but cc @rianniello / @smangelsdorf as FYI."}}