{"action":"created","issue":{"url":"https://api.github.com/repos/code-dot-org/code-dot-org/issues/6374","labels_url":"https://api.github.com/repos/code-dot-org/code-dot-org/issues/6374/labels{/name}","comments_url":"https://api.github.com/repos/code-dot-org/code-dot-org/issues/6374/comments","events_url":"https://api.github.com/repos/code-dot-org/code-dot-org/issues/6374/events","html_url":"https://github.com/code-dot-org/code-dot-org/pull/6374","id":127345246,"number":6374,"title":"sanitize html in applab [#104341490]","user":{"login":"davidsbailey","id":8001765,"avatar_url":"https://avatars.githubusercontent.com/u/8001765?v=3","gravatar_id":"","url":"https://api.github.com/users/davidsbailey","html_url":"https://github.com/davidsbailey","followers_url":"https://api.github.com/users/davidsbailey/followers","following_url":"https://api.github.com/users/davidsbailey/following{/other_user}","gists_url":"https://api.github.com/users/davidsbailey/gists{/gist_id}","starred_url":"https://api.github.com/users/davidsbailey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidsbailey/subscriptions","organizations_url":"https://api.github.com/users/davidsbailey/orgs","repos_url":"https://api.github.com/users/davidsbailey/repos","events_url":"https://api.github.com/users/davidsbailey/events{/privacy}","received_events_url":"https://api.github.com/users/davidsbailey/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"Bjvanminnen","id":1767466,"avatar_url":"https://avatars.githubusercontent.com/u/1767466?v=3","gravatar_id":"","url":"https://api.github.com/users/Bjvanminnen","html_url":"https://github.com/Bjvanminnen","followers_url":"https://api.github.com/users/Bjvanminnen/followers","following_url":"https://api.github.com/users/Bjvanminnen/following{/other_user}","gists_url":"https://api.github.com/users/Bjvanminnen/gists{/gist_id}","starred_url":"https://api.github.com/users/Bjvanminnen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bjvanminnen/subscriptions","organizations_url":"https://api.github.com/users/Bjvanminnen/orgs","repos_url":"https://api.github.com/users/Bjvanminnen/repos","events_url":"https://api.github.com/users/Bjvanminnen/events{/privacy}","received_events_url":"https://api.github.com/users/Bjvanminnen/received_events","type":"User","site_admin":false},"milestone":null,"comments":7,"created_at":"2016-01-19T01:42:32Z","updated_at":"2016-01-21T21:36:24Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/code-dot-org/code-dot-org/pulls/6374","html_url":"https://github.com/code-dot-org/code-dot-org/pull/6374","diff_url":"https://github.com/code-dot-org/code-dot-org/pull/6374.diff","patch_url":"https://github.com/code-dot-org/code-dot-org/pull/6374.patch"},"body":"pivotal item: https://www.pivotaltracker.com/projects/1256654/stories/104341490\r\ndev doc: https://docs.google.com/document/d/1JuIJT0ckZqxtR07_u7XpjnoB8Xy8NR6BCnOhcKL7D4Y/edit\r\n\r\n@Bjvanminnen could you please take a look at this PR and the dev doc above, and let me know if you agree with the approach? \r\n\r\nFYI @wjordan @philbogle @cpirich @islemaster please feel free to chime in!"},"comment":{"url":"https://api.github.com/repos/code-dot-org/code-dot-org/issues/comments/173715595","html_url":"https://github.com/code-dot-org/code-dot-org/pull/6374#issuecomment-173715595","issue_url":"https://api.github.com/repos/code-dot-org/code-dot-org/issues/6374","id":173715595,"user":{"login":"davidsbailey","id":8001765,"avatar_url":"https://avatars.githubusercontent.com/u/8001765?v=3","gravatar_id":"","url":"https://api.github.com/users/davidsbailey","html_url":"https://github.com/davidsbailey","followers_url":"https://api.github.com/users/davidsbailey/followers","following_url":"https://api.github.com/users/davidsbailey/following{/other_user}","gists_url":"https://api.github.com/users/davidsbailey/gists{/gist_id}","starred_url":"https://api.github.com/users/davidsbailey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidsbailey/subscriptions","organizations_url":"https://api.github.com/users/davidsbailey/orgs","repos_url":"https://api.github.com/users/davidsbailey/repos","events_url":"https://api.github.com/users/davidsbailey/events{/privacy}","received_events_url":"https://api.github.com/users/davidsbailey/received_events","type":"User","site_admin":false},"created_at":"2016-01-21T21:36:24Z","updated_at":"2016-01-21T21:36:24Z","body":"addressed feedback and added tests. tests have more warning spew unfortunately:\r\n```\r\n  Level tests\r\n    ../solutions/applab/ec_uicontrols.js\r\n      ✓ UI controls (578ms)\r\n      ✓ getText and setText on text labels. (221ms)\r\n      ✓ button (204ms)\r\n      ✓ setPosition (203ms)\r\nWARNING: Line: 1: button() id parameter refers to an id (button1) which already exists.\r\n      ✓ testDuplicateNamesWarning (185ms)\r\nERROR: Line: 1: Error: button() id parameter refers to an id (runButton) which is already in use outside of Applab. Choose a different id.\r\n      ✓ testIllegalNameError (207ms)\r\n      ✓ setSize (190ms)\r\n      ✓ cosmetic changes in html sanitization do not cause warnings (176ms)\r\nWARNING: Line: 1: The following lines of HTML were modified or removed:\r\n<img id=\"image6\" src=\"javascript:alert()\" />\r\n<script>alert()\r\n</script>\r\noriginal html:\r\n<div id=\"container\"><img id=\"image3\" src=\"\"><img id=\"image4\" src=\"//localhost:8001/apps/static/flappy_promo.png\" /><img id=\"image5\" src=\"data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" /><img id=\"image6\" src=\"javascript:alert()\" /><script>alert()</script></div>\r\nmodified html:\r\n<div id=\"container\"><img id=\"image3\" src /><img id=\"image4\" src=\"//localhost:8001/apps/static/flappy_promo.png\" /><img id=\"image5\" src=\"data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" /><img id=\"image6\" /></div>\r\n      ✓ substantial changes in html sanitization do cause warnings (209ms)\r\n```"}}