{"action":"opened","issue":{"url":"https://api.github.com/repos/Typesetter/Typesetter/issues/153","repository_url":"https://api.github.com/repos/Typesetter/Typesetter","labels_url":"https://api.github.com/repos/Typesetter/Typesetter/issues/153/labels{/name}","comments_url":"https://api.github.com/repos/Typesetter/Typesetter/issues/153/comments","events_url":"https://api.github.com/repos/Typesetter/Typesetter/issues/153/events","html_url":"https://github.com/Typesetter/Typesetter/issues/153","id":178904259,"number":153,"title":"Add HTMLPurifier as library for XSS prevention","user":{"login":"JPustkuchen","id":637807,"avatar_url":"https://avatars.githubusercontent.com/u/637807?v=3","gravatar_id":"","url":"https://api.github.com/users/JPustkuchen","html_url":"https://github.com/JPustkuchen","followers_url":"https://api.github.com/users/JPustkuchen/followers","following_url":"https://api.github.com/users/JPustkuchen/following{/other_user}","gists_url":"https://api.github.com/users/JPustkuchen/gists{/gist_id}","starred_url":"https://api.github.com/users/JPustkuchen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JPustkuchen/subscriptions","organizations_url":"https://api.github.com/users/JPustkuchen/orgs","repos_url":"https://api.github.com/users/JPustkuchen/repos","events_url":"https://api.github.com/users/JPustkuchen/events{/privacy}","received_events_url":"https://api.github.com/users/JPustkuchen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-23T15:19:16Z","updated_at":"2016-09-23T15:19:16Z","closed_at":null,"body":"Hi all,\r\n\r\nI'd like to suggest to add HTMLPurifier (http://htmlpurifier.org standalone or lite ) as standard library for XSS prevention in typesetter output.\r\nOn this page http://htmlpurifier.org/comparison you can see why I think it would be very useful for all plugins and the Typesetter core.\r\nstrip_tags and htmlspecialchars don't cove all situations. For example if you'd like to output allowed tags for administrators. strip_tags would always also allow javascript attributes even when blocking <javascript> elements.\r\n\r\nWe should not re-invent the wheel but use a proper standard and make it available to all Typesetter developers by default. What do you think?"}}
{"actor":{"display_login":"JPustkuchen"}}