{"action":"created","issue":{"url":"https://api.github.com/repos/godotengine/asset-library/issues/9","repository_url":"https://api.github.com/repos/godotengine/asset-library","labels_url":"https://api.github.com/repos/godotengine/asset-library/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/godotengine/asset-library/issues/9/comments","events_url":"https://api.github.com/repos/godotengine/asset-library/issues/9/events","html_url":"https://github.com/godotengine/asset-library/issues/9","id":167804046,"number":9,"title":"Check for XSS in templates","user":{"login":"Marqin","id":959429,"avatar_url":"https://avatars.githubusercontent.com/u/959429?v=3","gravatar_id":"","url":"https://api.github.com/users/Marqin","html_url":"https://github.com/Marqin","followers_url":"https://api.github.com/users/Marqin/followers","following_url":"https://api.github.com/users/Marqin/following{/other_user}","gists_url":"https://api.github.com/users/Marqin/gists{/gist_id}","starred_url":"https://api.github.com/users/Marqin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Marqin/subscriptions","organizations_url":"https://api.github.com/users/Marqin/orgs","repos_url":"https://api.github.com/users/Marqin/repos","events_url":"https://api.github.com/users/Marqin/events{/privacy}","received_events_url":"https://api.github.com/users/Marqin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/godotengine/asset-library/labels/help%20wanted","name":"help wanted","color":"128A0C"},{"url":"https://api.github.com/repos/godotengine/asset-library/labels/security","name":"security","color":"ff0000"},{"url":"https://api.github.com/repos/godotengine/asset-library/labels/topic:frontend","name":"topic:frontend","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-07-27T08:56:37Z","updated_at":"2016-07-27T09:07:07Z","closed_at":null,"body":"I've looked a little at code and I don't see any usage of [htmlspecialchars()](http://php.net/manual/en/function.htmlspecialchars.php) nor regexps for escaping HTML/JS - does it mean, that every user can put their own JS (including trojan horse, etc.) into asset name/describtion/etc?"},"comment":{"url":"https://api.github.com/repos/godotengine/asset-library/issues/comments/235529907","html_url":"https://github.com/godotengine/asset-library/issues/9#issuecomment-235529907","issue_url":"https://api.github.com/repos/godotengine/asset-library/issues/9","id":235529907,"user":{"login":"Marqin","id":959429,"avatar_url":"https://avatars.githubusercontent.com/u/959429?v=3","gravatar_id":"","url":"https://api.github.com/users/Marqin","html_url":"https://github.com/Marqin","followers_url":"https://api.github.com/users/Marqin/followers","following_url":"https://api.github.com/users/Marqin/following{/other_user}","gists_url":"https://api.github.com/users/Marqin/gists{/gist_id}","starred_url":"https://api.github.com/users/Marqin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Marqin/subscriptions","organizations_url":"https://api.github.com/users/Marqin/orgs","repos_url":"https://api.github.com/users/Marqin/repos","events_url":"https://api.github.com/users/Marqin/events{/privacy}","received_events_url":"https://api.github.com/users/Marqin/received_events","type":"User","site_admin":false},"created_at":"2016-07-27T09:07:07Z","updated_at":"2016-07-27T09:07:07Z","body":"`e(string)` may suggest it's something with `error` not `escape`"}}
{"actor":{"display_login":"Marqin"}}