{"action":"created","issue":{"url":"https://api.github.com/repos/KartikTalwar/gmail.js/issues/281","repository_url":"https://api.github.com/repos/KartikTalwar/gmail.js","labels_url":"https://api.github.com/repos/KartikTalwar/gmail.js/issues/281/labels{/name}","comments_url":"https://api.github.com/repos/KartikTalwar/gmail.js/issues/281/comments","events_url":"https://api.github.com/repos/KartikTalwar/gmail.js/issues/281/events","html_url":"https://github.com/KartikTalwar/gmail.js/issues/281","id":164978907,"number":281,"title":"Potential DOM Based Cross Site Scripting in gmail.js","user":{"login":"gursev","id":203835,"avatar_url":"https://avatars.githubusercontent.com/u/203835?v=3","gravatar_id":"","url":"https://api.github.com/users/gursev","html_url":"https://github.com/gursev","followers_url":"https://api.github.com/users/gursev/followers","following_url":"https://api.github.com/users/gursev/following{/other_user}","gists_url":"https://api.github.com/users/gursev/gists{/gist_id}","starred_url":"https://api.github.com/users/gursev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gursev/subscriptions","organizations_url":"https://api.github.com/users/gursev/orgs","repos_url":"https://api.github.com/users/gursev/repos","events_url":"https://api.github.com/users/gursev/events{/privacy}","received_events_url":"https://api.github.com/users/gursev/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-07-12T02:07:26Z","updated_at":"2016-11-29T06:46:17Z","closed_at":null,"body":"The gmail.js library dynamically creates functions out of response data and executes them, leading to potential DOM based XSS issues.\n\nInstance 1:\n\n``` js\n  api.tools.parse_response = function(response) {\n      var parsedResponse = [],\n          data, dataLength, endIndex, realData;\n\n      try {\n\n        // gmail post response structure\n        // )}]'\\n<datalength><rawData>\\n<dataLength><rawData>...\n\n        // prepare response, remove eval protectors\n        response = response.replace(/\\n/g, ' ');\n        response = response.substring(response.indexOf(\"'\") + 1, response.length);\n\n        while(response.replace(/\\s/g, '').length > 1) {\n\n          // how long is the data to get\n          dataLength = response.substring(0, response.indexOf('[')).replace(/\\s/g, '');\n          if (!dataLength) {dataLength = response.length;}\n\n          endIndex = (parseInt(dataLength, 10) - 2) + response.indexOf('[');\n          data = response.substring(response.indexOf('['), endIndex);\n\n          var get_data = new Function('\"use strict\"; return ' + data); // DOM XSS when data is 'alert(1);'\n\n```\n\nInstance 2:\n\n``` js\n  api.helper.get.visible_emails_post = function(get_data) {\n    var emails = [];\n\n    var get_data = get_data.substring(get_data.indexOf('['), get_data.length);\n        get_data = '\"use strict\"; return ' + get_data;\n        get_data = new Function(get_data); // DOM XSS when data is 'alert(1);'\n```\n\nInstance 3:\n\n``` js\n  api.helper.get.email_data_post = function(get_data) {\n    var get_data = get_data.substring(get_data.indexOf('['), get_data.length);\n        get_data = '\"use strict\"; return ' + get_data;\n        get_data = new Function(get_data); // DOM XSS when data is 'alert(1);'\n```\n\n@KartikTalwar \n"},"comment":{"url":"https://api.github.com/repos/KartikTalwar/gmail.js/issues/comments/263490331","html_url":"https://github.com/KartikTalwar/gmail.js/issues/281#issuecomment-263490331","issue_url":"https://api.github.com/repos/KartikTalwar/gmail.js/issues/281","id":263490331,"user":{"login":"josteink","id":411338,"avatar_url":"https://avatars.githubusercontent.com/u/411338?v=3","gravatar_id":"","url":"https://api.github.com/users/josteink","html_url":"https://github.com/josteink","followers_url":"https://api.github.com/users/josteink/followers","following_url":"https://api.github.com/users/josteink/following{/other_user}","gists_url":"https://api.github.com/users/josteink/gists{/gist_id}","starred_url":"https://api.github.com/users/josteink/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josteink/subscriptions","organizations_url":"https://api.github.com/users/josteink/orgs","repos_url":"https://api.github.com/users/josteink/repos","events_url":"https://api.github.com/users/josteink/events{/privacy}","received_events_url":"https://api.github.com/users/josteink/received_events","type":"User","site_admin":false},"created_at":"2016-11-29T06:46:17Z","updated_at":"2016-11-29T06:46:17Z","body":"It's been suggested to me that we could use `JSON.parse` instead of creating a new `Function`-object, and in general that seems reasonable.\r\n\r\nBased on the *extremely limited* testing I've done with `api.tools.parse_response`, this works for me. \r\n\r\nTo facilitate more thorough testing, I can create a feature-branch where all use of `new Function()` is replaced by `JSON.parse`. Interested parties can then test this code and report back if that works for them.\r\n\r\nIf so, we can merge this back to master. Sounds like a plan?"}}
{"actor":{"display_login":"josteink"}}