{"action":"created","issue":{"url":"https://api.github.com/repos/moneyadviceservice/frontend/issues/1591","repository_url":"https://api.github.com/repos/moneyadviceservice/frontend","labels_url":"https://api.github.com/repos/moneyadviceservice/frontend/issues/1591/labels{/name}","comments_url":"https://api.github.com/repos/moneyadviceservice/frontend/issues/1591/comments","events_url":"https://api.github.com/repos/moneyadviceservice/frontend/issues/1591/events","html_url":"https://github.com/moneyadviceservice/frontend/pull/1591","id":187760943,"number":1591,"title":"use rails sanitize gem not html_escape","user":{"login":"Tr4pSt3R","id":591781,"avatar_url":"https://avatars.githubusercontent.com/u/591781?v=3","gravatar_id":"","url":"https://api.github.com/users/Tr4pSt3R","html_url":"https://github.com/Tr4pSt3R","followers_url":"https://api.github.com/users/Tr4pSt3R/followers","following_url":"https://api.github.com/users/Tr4pSt3R/following{/other_user}","gists_url":"https://api.github.com/users/Tr4pSt3R/gists{/gist_id}","starred_url":"https://api.github.com/users/Tr4pSt3R/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tr4pSt3R/subscriptions","organizations_url":"https://api.github.com/users/Tr4pSt3R/orgs","repos_url":"https://api.github.com/users/Tr4pSt3R/repos","events_url":"https://api.github.com/users/Tr4pSt3R/events{/privacy}","received_events_url":"https://api.github.com/users/Tr4pSt3R/received_events","type":"User","site_admin":false},"labels":[{"id":71403378,"url":"https://api.github.com/repos/moneyadviceservice/frontend/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":{"login":"Tr4pSt3R","id":591781,"avatar_url":"https://avatars.githubusercontent.com/u/591781?v=3","gravatar_id":"","url":"https://api.github.com/users/Tr4pSt3R","html_url":"https://github.com/Tr4pSt3R","followers_url":"https://api.github.com/users/Tr4pSt3R/followers","following_url":"https://api.github.com/users/Tr4pSt3R/following{/other_user}","gists_url":"https://api.github.com/users/Tr4pSt3R/gists{/gist_id}","starred_url":"https://api.github.com/users/Tr4pSt3R/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tr4pSt3R/subscriptions","organizations_url":"https://api.github.com/users/Tr4pSt3R/orgs","repos_url":"https://api.github.com/users/Tr4pSt3R/repos","events_url":"https://api.github.com/users/Tr4pSt3R/events{/privacy}","received_events_url":"https://api.github.com/users/Tr4pSt3R/received_events","type":"User","site_admin":false},"assignees":[{"login":"Tr4pSt3R","id":591781,"avatar_url":"https://avatars.githubusercontent.com/u/591781?v=3","gravatar_id":"","url":"https://api.github.com/users/Tr4pSt3R","html_url":"https://github.com/Tr4pSt3R","followers_url":"https://api.github.com/users/Tr4pSt3R/followers","following_url":"https://api.github.com/users/Tr4pSt3R/following{/other_user}","gists_url":"https://api.github.com/users/Tr4pSt3R/gists{/gist_id}","starred_url":"https://api.github.com/users/Tr4pSt3R/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tr4pSt3R/subscriptions","organizations_url":"https://api.github.com/users/Tr4pSt3R/orgs","repos_url":"https://api.github.com/users/Tr4pSt3R/repos","events_url":"https://api.github.com/users/Tr4pSt3R/events{/privacy}","received_events_url":"https://api.github.com/users/Tr4pSt3R/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2016-11-07T16:37:31Z","updated_at":"2016-11-08T12:12:48Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/moneyadviceservice/frontend/pulls/1591","html_url":"https://github.com/moneyadviceservice/frontend/pull/1591","diff_url":"https://github.com/moneyadviceservice/frontend/pull/1591.diff","patch_url":"https://github.com/moneyadviceservice/frontend/pull/1591.patch"},"body":"Cross-Site Scripting opens up our application for manipulation in ways we never intended them to be used. This vulnerability puts user data at risk. It also has the potential to ruin the experience of other users of the MAS website. \r\n\r\nSee more about this card on [Target Process](https://moneyadviceservice.tpondemand.com/entity/7578)\r\n\r\n## Previously\r\n![screen shot 2016-11-08 at 10 18 36](https://cloud.githubusercontent.com/assets/591781/20095298/e29f554e-a59c-11e6-89f1-d78b0a419b4a.png)\r\n\r\n## Currently\r\n![screen shot 2016-11-08 at 10 19 13](https://cloud.githubusercontent.com/assets/591781/20095310/ec5f593a-a59c-11e6-8736-a965863a4b2a.png)\n\n<!-- Reviewable:start -->\n---\nThis change is [<img src=\"https://reviewable.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.io/reviews/moneyadviceservice/frontend/1591)\n<!-- Reviewable:end -->\n"},"comment":{"url":"https://api.github.com/repos/moneyadviceservice/frontend/issues/comments/259121164","html_url":"https://github.com/moneyadviceservice/frontend/pull/1591#issuecomment-259121164","issue_url":"https://api.github.com/repos/moneyadviceservice/frontend/issues/1591","id":259121164,"user":{"login":"jongilbraith","id":9943,"avatar_url":"https://avatars.githubusercontent.com/u/9943?v=3","gravatar_id":"","url":"https://api.github.com/users/jongilbraith","html_url":"https://github.com/jongilbraith","followers_url":"https://api.github.com/users/jongilbraith/followers","following_url":"https://api.github.com/users/jongilbraith/following{/other_user}","gists_url":"https://api.github.com/users/jongilbraith/gists{/gist_id}","starred_url":"https://api.github.com/users/jongilbraith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jongilbraith/subscriptions","organizations_url":"https://api.github.com/users/jongilbraith/orgs","repos_url":"https://api.github.com/users/jongilbraith/repos","events_url":"https://api.github.com/users/jongilbraith/events{/privacy}","received_events_url":"https://api.github.com/users/jongilbraith/received_events","type":"User","site_admin":false},"created_at":"2016-11-08T12:12:48Z","updated_at":"2016-11-08T12:12:48Z","body":"Ok, now I think about it a bit more(!), it's the `element.class_name` bit that's the risk, but again, this comes from the Kss gem which again, [pulls the data from the stylesheet comments](https://github.com/kneath/kss/blob/b0791708cb397f5e8995a855af0d1a8b0aa89a2e/lib/kss/modifier.rb#L31), from the filesystem."}}
{"actor":{"display_login":"jongilbraith"}}