{"action":"created","issue":{"url":"https://api.github.com/repos/cure53/DOMPurify/issues/177","repository_url":"https://api.github.com/repos/cure53/DOMPurify","labels_url":"https://api.github.com/repos/cure53/DOMPurify/issues/177/labels{/name}","comments_url":"https://api.github.com/repos/cure53/DOMPurify/issues/177/comments","events_url":"https://api.github.com/repos/cure53/DOMPurify/issues/177/events","html_url":"https://github.com/cure53/DOMPurify/issues/177","id":170990462,"number":177,"title":"Possible in-site request forgery by abusing HTML custom data attributes","user":{"login":"deadstar1","id":6646675,"avatar_url":"https://avatars.githubusercontent.com/u/6646675?v=3","gravatar_id":"","url":"https://api.github.com/users/deadstar1","html_url":"https://github.com/deadstar1","followers_url":"https://api.github.com/users/deadstar1/followers","following_url":"https://api.github.com/users/deadstar1/following{/other_user}","gists_url":"https://api.github.com/users/deadstar1/gists{/gist_id}","starred_url":"https://api.github.com/users/deadstar1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deadstar1/subscriptions","organizations_url":"https://api.github.com/users/deadstar1/orgs","repos_url":"https://api.github.com/users/deadstar1/repos","events_url":"https://api.github.com/users/deadstar1/events{/privacy}","received_events_url":"https://api.github.com/users/deadstar1/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-08-13T03:25:35Z","updated_at":"2016-08-13T16:04:27Z","closed_at":null,"body":"Since dompurity supports HTML custom data attributes, it is possible to abuse these data attributes to craft a HTTP request but this only possible if the web application is using JQUERY([Unobtrusive scripting support for jQuery](https://github.com/rails/jquery-ujs/wiki/Unobtrusive-scripting-support-for-jQuery)).\r\n\r\n**For example**\r\n![image](https://cloud.githubusercontent.com/assets/6646675/17641201/75495f8c-6148-11e6-8fbc-c69c1b6b14f4.png)\r\n\r\nif the user clicks the anchor tag, a Post request is send and may include the user's csrf token.\r\n\r\n\r\n "},"comment":{"url":"https://api.github.com/repos/cure53/DOMPurify/issues/comments/239628177","html_url":"https://github.com/cure53/DOMPurify/issues/177#issuecomment-239628177","issue_url":"https://api.github.com/repos/cure53/DOMPurify/issues/177","id":239628177,"user":{"login":"cure53","id":6709482,"avatar_url":"https://avatars.githubusercontent.com/u/6709482?v=3","gravatar_id":"","url":"https://api.github.com/users/cure53","html_url":"https://github.com/cure53","followers_url":"https://api.github.com/users/cure53/followers","following_url":"https://api.github.com/users/cure53/following{/other_user}","gists_url":"https://api.github.com/users/cure53/gists{/gist_id}","starred_url":"https://api.github.com/users/cure53/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cure53/subscriptions","organizations_url":"https://api.github.com/users/cure53/orgs","repos_url":"https://api.github.com/users/cure53/repos","events_url":"https://api.github.com/users/cure53/events{/privacy}","received_events_url":"https://api.github.com/users/cure53/received_events","type":"User","site_admin":false},"created_at":"2016-08-13T16:04:27Z","updated_at":"2016-08-13T16:04:27Z","body":"Oh, and - do you by any chance have a JSFiddle or JSBin handy to demo the problem? Thanks!"}}
{"actor":{"display_login":"cure53"}}