{"action":"closed","number":9,"pull_request":{"url":"https://api.github.com/repos/straker/html-tagged-template/pulls/9","id":60145373,"html_url":"https://github.com/straker/html-tagged-template/pull/9","diff_url":"https://github.com/straker/html-tagged-template/pull/9.diff","patch_url":"https://github.com/straker/html-tagged-template/pull/9.patch","issue_url":"https://api.github.com/repos/straker/html-tagged-template/issues/9","number":9,"state":"closed","locked":false,"title":"DOM Clobbering test","user":{"login":"mozfreddyb","id":5418775,"avatar_url":"https://avatars.githubusercontent.com/u/5418775?v=3","gravatar_id":"","url":"https://api.github.com/users/mozfreddyb","html_url":"https://github.com/mozfreddyb","followers_url":"https://api.github.com/users/mozfreddyb/followers","following_url":"https://api.github.com/users/mozfreddyb/following{/other_user}","gists_url":"https://api.github.com/users/mozfreddyb/gists{/gist_id}","starred_url":"https://api.github.com/users/mozfreddyb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozfreddyb/subscriptions","organizations_url":"https://api.github.com/users/mozfreddyb/orgs","repos_url":"https://api.github.com/users/mozfreddyb/repos","events_url":"https://api.github.com/users/mozfreddyb/events{/privacy}","received_events_url":"https://api.github.com/users/mozfreddyb/received_events","type":"User","site_admin":false},"body":"The current way to inspect `node.attributes` is prone to DOM clobbering, e.g., the code will look at child elements with `name=\"attributes\"` instead of the actual attributes.\r\n\r\nI suppose this needs discussion on how you want to fix these issues. The DOMPurify library handles this by [checking nodes before accessing their properties](https://github.com/cure53/DOMPurify/blob/924a4ac5151c3f6b7fd8a7654c370bf2ae253b28/src/purify.js#L398):\r\n```\r\n    /**\r\n     * _isClobbered\r\n     *\r\n     * @param  element to check for clobbering attacks\r\n     * @return true if clobbered, false if safe\r\n     */\r\n    var _isClobbered = function(elm) {\r\n        if (elm instanceof Text || elm instanceof Comment) {\r\n            return false;\r\n        }\r\n        if (  typeof elm.nodeName !== 'string'\r\n           || typeof elm.textContent !== 'string'\r\n           || typeof elm.removeChild !== 'function'\r\n           || !(elm.attributes instanceof NamedNodeMap)\r\n           || typeof elm.removeAttribute !== 'function'\r\n           || typeof elm.setAttribute !== 'function'\r\n        ) {\r\n            return true;\r\n        }\r\n        return false;\r\n    };\r\n```","created_at":"2016-02-22T09:30:51Z","updated_at":"2016-10-16T05:51:42Z","closed_at":"2016-10-16T05:51:42Z","merged_at":null,"merge_commit_sha":"e387c087547631fe06d5eb3c75f1dbad12a03a5f","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/straker/html-tagged-template/pulls/9/commits","review_comments_url":"https://api.github.com/repos/straker/html-tagged-template/pulls/9/comments","review_comment_url":"https://api.github.com/repos/straker/html-tagged-template/pulls/comments{/number}","comments_url":"https://api.github.com/repos/straker/html-tagged-template/issues/9/comments","statuses_url":"https://api.github.com/repos/straker/html-tagged-template/statuses/b3757e326106290d78933b78bcaf0750c416a190","head":{"label":"mozfreddyb:clobber-attributes","ref":"clobber-attributes","sha":"b3757e326106290d78933b78bcaf0750c416a190","user":{"login":"mozfreddyb","id":5418775,"avatar_url":"https://avatars.githubusercontent.com/u/5418775?v=3","gravatar_id":"","url":"https://api.github.com/users/mozfreddyb","html_url":"https://github.com/mozfreddyb","followers_url":"https://api.github.com/users/mozfreddyb/followers","following_url":"https://api.github.com/users/mozfreddyb/following{/other_user}","gists_url":"https://api.github.com/users/mozfreddyb/gists{/gist_id}","starred_url":"https://api.github.com/users/mozfreddyb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozfreddyb/subscriptions","organizations_url":"https://api.github.com/users/mozfreddyb/orgs","repos_url":"https://api.github.com/users/mozfreddyb/repos","events_url":"https://api.github.com/users/mozfreddyb/events{/privacy}","received_events_url":"https://api.github.com/users/mozfreddyb/received_events","type":"User","site_admin":false},"repo":{"id":52261249,"name":"html-tagged-template","full_name":"mozfreddyb/html-tagged-template","owner":{"login":"mozfreddyb","id":5418775,"avatar_url":"https://avatars.githubusercontent.com/u/5418775?v=3","gravatar_id":"","url":"https://api.github.com/users/mozfreddyb","html_url":"https://github.com/mozfreddyb","followers_url":"https://api.github.com/users/mozfreddyb/followers","following_url":"https://api.github.com/users/mozfreddyb/following{/other_user}","gists_url":"https://api.github.com/users/mozfreddyb/gists{/gist_id}","starred_url":"https://api.github.com/users/mozfreddyb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozfreddyb/subscriptions","organizations_url":"https://api.github.com/users/mozfreddyb/orgs","repos_url":"https://api.github.com/users/mozfreddyb/repos","events_url":"https://api.github.com/users/mozfreddyb/events{/privacy}","received_events_url":"https://api.github.com/users/mozfreddyb/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mozfreddyb/html-tagged-template","description":"Proposal to improve the DOM creation API so developers have a cleaner, simpler interface to DOM creation and manipulation.","fork":true,"url":"https://api.github.com/repos/mozfreddyb/html-tagged-template","forks_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/forks","keys_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/teams","hooks_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/hooks","issue_events_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/issues/events{/number}","events_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/events","assignees_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/assignees{/user}","branches_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/branches{/branch}","tags_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/tags","blobs_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/statuses/{sha}","languages_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/languages","stargazers_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/stargazers","contributors_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/contributors","subscribers_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/subscribers","subscription_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/subscription","commits_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/issues/comments{/number}","contents_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/contents/{+path}","compare_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/merges","archive_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/downloads","issues_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/issues{/number}","pulls_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/pulls{/number}","milestones_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/milestones{/number}","notifications_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/labels{/name}","releases_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/releases{/id}","deployments_url":"https://api.github.com/repos/mozfreddyb/html-tagged-template/deployments","created_at":"2016-02-22T09:14:42Z","updated_at":"2016-02-22T09:14:44Z","pushed_at":"2016-02-22T09:28:03Z","git_url":"git://github.com/mozfreddyb/html-tagged-template.git","ssh_url":"git@github.com:mozfreddyb/html-tagged-template.git","clone_url":"https://github.com/mozfreddyb/html-tagged-template.git","svn_url":"https://github.com/mozfreddyb/html-tagged-template","homepage":"","size":44,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"straker:master","ref":"master","sha":"de81eeaf4e1568da25c1692ebf1d35f471f68a46","user":{"login":"straker","id":2433219,"avatar_url":"https://avatars.githubusercontent.com/u/2433219?v=3","gravatar_id":"","url":"https://api.github.com/users/straker","html_url":"https://github.com/straker","followers_url":"https://api.github.com/users/straker/followers","following_url":"https://api.github.com/users/straker/following{/other_user}","gists_url":"https://api.github.com/users/straker/gists{/gist_id}","starred_url":"https://api.github.com/users/straker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/straker/subscriptions","organizations_url":"https://api.github.com/users/straker/orgs","repos_url":"https://api.github.com/users/straker/repos","events_url":"https://api.github.com/users/straker/events{/privacy}","received_events_url":"https://api.github.com/users/straker/received_events","type":"User","site_admin":false},"repo":{"id":51575788,"name":"html-tagged-template","full_name":"straker/html-tagged-template","owner":{"login":"straker","id":2433219,"avatar_url":"https://avatars.githubusercontent.com/u/2433219?v=3","gravatar_id":"","url":"https://api.github.com/users/straker","html_url":"https://github.com/straker","followers_url":"https://api.github.com/users/straker/followers","following_url":"https://api.github.com/users/straker/following{/other_user}","gists_url":"https://api.github.com/users/straker/gists{/gist_id}","starred_url":"https://api.github.com/users/straker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/straker/subscriptions","organizations_url":"https://api.github.com/users/straker/orgs","repos_url":"https://api.github.com/users/straker/repos","events_url":"https://api.github.com/users/straker/events{/privacy}","received_events_url":"https://api.github.com/users/straker/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/straker/html-tagged-template","description":"Proposal to improve the DOM creation API so developers have a cleaner, simpler interface to DOM creation and manipulation.","fork":false,"url":"https://api.github.com/repos/straker/html-tagged-template","forks_url":"https://api.github.com/repos/straker/html-tagged-template/forks","keys_url":"https://api.github.com/repos/straker/html-tagged-template/keys{/key_id}","collaborators_url":"https://api.github.com/repos/straker/html-tagged-template/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/straker/html-tagged-template/teams","hooks_url":"https://api.github.com/repos/straker/html-tagged-template/hooks","issue_events_url":"https://api.github.com/repos/straker/html-tagged-template/issues/events{/number}","events_url":"https://api.github.com/repos/straker/html-tagged-template/events","assignees_url":"https://api.github.com/repos/straker/html-tagged-template/assignees{/user}","branches_url":"https://api.github.com/repos/straker/html-tagged-template/branches{/branch}","tags_url":"https://api.github.com/repos/straker/html-tagged-template/tags","blobs_url":"https://api.github.com/repos/straker/html-tagged-template/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/straker/html-tagged-template/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/straker/html-tagged-template/git/refs{/sha}","trees_url":"https://api.github.com/repos/straker/html-tagged-template/git/trees{/sha}","statuses_url":"https://api.github.com/repos/straker/html-tagged-template/statuses/{sha}","languages_url":"https://api.github.com/repos/straker/html-tagged-template/languages","stargazers_url":"https://api.github.com/repos/straker/html-tagged-template/stargazers","contributors_url":"https://api.github.com/repos/straker/html-tagged-template/contributors","subscribers_url":"https://api.github.com/repos/straker/html-tagged-template/subscribers","subscription_url":"https://api.github.com/repos/straker/html-tagged-template/subscription","commits_url":"https://api.github.com/repos/straker/html-tagged-template/commits{/sha}","git_commits_url":"https://api.github.com/repos/straker/html-tagged-template/git/commits{/sha}","comments_url":"https://api.github.com/repos/straker/html-tagged-template/comments{/number}","issue_comment_url":"https://api.github.com/repos/straker/html-tagged-template/issues/comments{/number}","contents_url":"https://api.github.com/repos/straker/html-tagged-template/contents/{+path}","compare_url":"https://api.github.com/repos/straker/html-tagged-template/compare/{base}...{head}","merges_url":"https://api.github.com/repos/straker/html-tagged-template/merges","archive_url":"https://api.github.com/repos/straker/html-tagged-template/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/straker/html-tagged-template/downloads","issues_url":"https://api.github.com/repos/straker/html-tagged-template/issues{/number}","pulls_url":"https://api.github.com/repos/straker/html-tagged-template/pulls{/number}","milestones_url":"https://api.github.com/repos/straker/html-tagged-template/milestones{/number}","notifications_url":"https://api.github.com/repos/straker/html-tagged-template/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/straker/html-tagged-template/labels{/name}","releases_url":"https://api.github.com/repos/straker/html-tagged-template/releases{/id}","deployments_url":"https://api.github.com/repos/straker/html-tagged-template/deployments","created_at":"2016-02-12T08:38:54Z","updated_at":"2016-07-18T14:55:54Z","pushed_at":"2016-10-16T05:51:42Z","git_url":"git://github.com/straker/html-tagged-template.git","ssh_url":"git@github.com:straker/html-tagged-template.git","clone_url":"https://github.com/straker/html-tagged-template.git","svn_url":"https://github.com/straker/html-tagged-template","homepage":"","size":68,"stargazers_count":47,"watchers_count":47,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":4,"mirror_url":null,"open_issues_count":2,"forks":4,"open_issues":2,"watchers":47,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/straker/html-tagged-template/pulls/9"},"html":{"href":"https://github.com/straker/html-tagged-template/pull/9"},"issue":{"href":"https://api.github.com/repos/straker/html-tagged-template/issues/9"},"comments":{"href":"https://api.github.com/repos/straker/html-tagged-template/issues/9/comments"},"review_comments":{"href":"https://api.github.com/repos/straker/html-tagged-template/pulls/9/comments"},"review_comment":{"href":"https://api.github.com/repos/straker/html-tagged-template/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/straker/html-tagged-template/pulls/9/commits"},"statuses":{"href":"https://api.github.com/repos/straker/html-tagged-template/statuses/b3757e326106290d78933b78bcaf0750c416a190"}},"merged":false,"mergeable":false,"mergeable_state":"dirty","merged_by":null,"comments":2,"review_comments":0,"commits":1,"additions":9,"deletions":1,"changed_files":1}}
{"actor":{"display_login":"straker"}}