{"action":"created","issue":{"url":"https://api.github.com/repos/codef0rmer/angular-dragdrop/issues/285","repository_url":"https://api.github.com/repos/codef0rmer/angular-dragdrop","labels_url":"https://api.github.com/repos/codef0rmer/angular-dragdrop/issues/285/labels{/name}","comments_url":"https://api.github.com/repos/codef0rmer/angular-dragdrop/issues/285/comments","events_url":"https://api.github.com/repos/codef0rmer/angular-dragdrop/issues/285/events","html_url":"https://github.com/codef0rmer/angular-dragdrop/issues/285","id":162128323,"number":285,"title":"Seems like the drag template is vulnerable for XSS attacks","user":{"login":"benbracha","id":3404050,"avatar_url":"https://avatars.githubusercontent.com/u/3404050?v=3","gravatar_id":"","url":"https://api.github.com/users/benbracha","html_url":"https://github.com/benbracha","followers_url":"https://api.github.com/users/benbracha/followers","following_url":"https://api.github.com/users/benbracha/following{/other_user}","gists_url":"https://api.github.com/users/benbracha/gists{/gist_id}","starred_url":"https://api.github.com/users/benbracha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benbracha/subscriptions","organizations_url":"https://api.github.com/users/benbracha/orgs","repos_url":"https://api.github.com/users/benbracha/repos","events_url":"https://api.github.com/users/benbracha/events{/privacy}","received_events_url":"https://api.github.com/users/benbracha/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-06-24T11:30:45Z","updated_at":"2016-06-29T09:03:24Z","closed_at":"2016-06-24T12:38:10Z","body":"We create a drag item template which is based on user's input (e.g. item name).\r\nSeems that this behaviour is vulnerable for XSS attack, in case the user put a script tag in the item name.\r\nWe can sanitize user's input, but as developers usually rely on Angular automatic sanitization process, we think that the data-jqyoui-options directive should take care of this as well, if possible.\r\n\r\nFor example, try to define this draggable item:\r\n```\r\n<div\r\n   data-drag=\"true\"\r\n   jqyoui-draggable\r\n   data-jqyoui-options=\"{helper: getItemDragTemplate(), appendTo: 'body'}\">\r\n```\r\n\r\nWhere the getItemDragTemlpate is:\r\n```\r\n<div>item.name</div>\r\n```\r\nWhere item.name is some user malicious input, for example:\r\n```\r\n<script>alert('hello')</script>\r\n```\r\n\r\nDragging such an item will cause the script to run.\r\n"},"comment":{"url":"https://api.github.com/repos/codef0rmer/angular-dragdrop/issues/comments/229299246","html_url":"https://github.com/codef0rmer/angular-dragdrop/issues/285#issuecomment-229299246","issue_url":"https://api.github.com/repos/codef0rmer/angular-dragdrop/issues/285","id":229299246,"user":{"login":"codef0rmer","id":167227,"avatar_url":"https://avatars.githubusercontent.com/u/167227?v=3","gravatar_id":"","url":"https://api.github.com/users/codef0rmer","html_url":"https://github.com/codef0rmer","followers_url":"https://api.github.com/users/codef0rmer/followers","following_url":"https://api.github.com/users/codef0rmer/following{/other_user}","gists_url":"https://api.github.com/users/codef0rmer/gists{/gist_id}","starred_url":"https://api.github.com/users/codef0rmer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/codef0rmer/subscriptions","organizations_url":"https://api.github.com/users/codef0rmer/orgs","repos_url":"https://api.github.com/users/codef0rmer/repos","events_url":"https://api.github.com/users/codef0rmer/events{/privacy}","received_events_url":"https://api.github.com/users/codef0rmer/received_events","type":"User","site_admin":false},"created_at":"2016-06-29T09:03:24Z","updated_at":"2016-06-29T09:03:24Z","body":"@benbracha I really appreciate your efforts in providing the solution. However, not everybody allows to modify the markup before dragging/dropping unlike your requirement. That's why I did not want to add the fix in angular-dragdrop. I hope it clarifies the issue."}}
{"actor":{"display_login":"codef0rmer"}}