{"action":"created","issue":{"url":"https://api.github.com/repos/jsdoc3/jsdoc/issues/1200","repository_url":"https://api.github.com/repos/jsdoc3/jsdoc","labels_url":"https://api.github.com/repos/jsdoc3/jsdoc/issues/1200/labels{/name}","comments_url":"https://api.github.com/repos/jsdoc3/jsdoc/issues/1200/comments","events_url":"https://api.github.com/repos/jsdoc3/jsdoc/issues/1200/events","html_url":"https://github.com/jsdoc3/jsdoc/issues/1200","id":150926884,"number":1200,"title":"Warning Dependency Vulnerability: `marked`","user":{"login":"danactive","id":1093286,"avatar_url":"https://avatars.githubusercontent.com/u/1093286?v=3","gravatar_id":"","url":"https://api.github.com/users/danactive","html_url":"https://github.com/danactive","followers_url":"https://api.github.com/users/danactive/followers","following_url":"https://api.github.com/users/danactive/following{/other_user}","gists_url":"https://api.github.com/users/danactive/gists{/gist_id}","starred_url":"https://api.github.com/users/danactive/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danactive/subscriptions","organizations_url":"https://api.github.com/users/danactive/orgs","repos_url":"https://api.github.com/users/danactive/repos","events_url":"https://api.github.com/users/danactive/events{/privacy}","received_events_url":"https://api.github.com/users/danactive/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-04-25T17:06:07Z","updated_at":"2016-08-25T23:49:47Z","closed_at":"2016-08-25T23:49:47Z","body":"JSDoc has been flagged by Node Security Project as **vulnerability** due to the `marked` dependency for Markdown compilation to HTML. Read more about the [Sanitization bypass using HTML Entities](https://nodesecurity.io/advisories/101).\r\n\r\nProblem code sample:\r\nWith the sanitize option on it is possible to create a link with a javascript: protocol with the following:\r\n```\r\n[URL](javascript&#58document;alert&#40;1&#41;).\r\n```\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/jsdoc3/jsdoc/issues/comments/242581667","html_url":"https://github.com/jsdoc3/jsdoc/issues/1200#issuecomment-242581667","issue_url":"https://api.github.com/repos/jsdoc3/jsdoc/issues/1200","id":242581667,"user":{"login":"hegemonic","id":1522391,"avatar_url":"https://avatars.githubusercontent.com/u/1522391?v=3","gravatar_id":"","url":"https://api.github.com/users/hegemonic","html_url":"https://github.com/hegemonic","followers_url":"https://api.github.com/users/hegemonic/followers","following_url":"https://api.github.com/users/hegemonic/following{/other_user}","gists_url":"https://api.github.com/users/hegemonic/gists{/gist_id}","starred_url":"https://api.github.com/users/hegemonic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hegemonic/subscriptions","organizations_url":"https://api.github.com/users/hegemonic/orgs","repos_url":"https://api.github.com/users/hegemonic/repos","events_url":"https://api.github.com/users/hegemonic/events{/privacy}","received_events_url":"https://api.github.com/users/hegemonic/received_events","type":"User","site_admin":false},"created_at":"2016-08-25T23:49:47Z","updated_at":"2016-08-25T23:49:47Z","body":"I'm not concerned about this vulnerability, because JSDoc isn't designed to accept random user input.\r\n\r\nI agree that in the long run, it would be good to upgrade to a supported Markdown processor, but I'd prefer not to do that right this second. I'll file a separate issue for that."}}
{"actor":{"display_login":"hegemonic"}}