{"action":"created","issue":{"url":"https://api.github.com/repos/edx/bok-choy/issues/144","repository_url":"https://api.github.com/repos/edx/bok-choy","labels_url":"https://api.github.com/repos/edx/bok-choy/issues/144/labels{/name}","comments_url":"https://api.github.com/repos/edx/bok-choy/issues/144/comments","events_url":"https://api.github.com/repos/edx/bok-choy/issues/144/events","html_url":"https://github.com/edx/bok-choy/pull/144","id":143513635,"number":144,"title":"Generalize the XSS false positives check.","user":{"login":"cahrens","id":484484,"avatar_url":"https://avatars.githubusercontent.com/u/484484?v=3","gravatar_id":"","url":"https://api.github.com/users/cahrens","html_url":"https://github.com/cahrens","followers_url":"https://api.github.com/users/cahrens/followers","following_url":"https://api.github.com/users/cahrens/following{/other_user}","gists_url":"https://api.github.com/users/cahrens/gists{/gist_id}","starred_url":"https://api.github.com/users/cahrens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cahrens/subscriptions","organizations_url":"https://api.github.com/users/cahrens/orgs","repos_url":"https://api.github.com/users/cahrens/repos","events_url":"https://api.github.com/users/cahrens/events{/privacy}","received_events_url":"https://api.github.com/users/cahrens/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-25T14:35:55Z","updated_at":"2016-03-25T21:15:35Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/edx/bok-choy/pulls/144","html_url":"https://github.com/edx/bok-choy/pull/144","diff_url":"https://github.com/edx/bok-choy/pull/144.diff","patch_url":"https://github.com/edx/bok-choy/pull/144.patch"},"body":"While working on cleaning up a set of templates, I found that false positives were not limited to the value attribute of the input tag (see https://github.com/edx/edx-platform/pull/11926).\r\n\r\n@robrap and I decided the best thing was just to allow the very specific escaping that we get from such an attribute field (as returned by the document method).\r\n\r\nI verified that we do not lose any actual failures with this change (https://build.testeng.edx.org/view/edx-platform-specific-tests/job/edx-platform-bok-choy-custom/255/#showFailuresLink).\r\n\r\nTicket: https://openedx.atlassian.net/browse/TNL-4295\r\n\r\nPlease review @jzoldak and @robrap \r\nNote that I will want to release a new version of bok choy after this.\r\n"},"comment":{"url":"https://api.github.com/repos/edx/bok-choy/issues/comments/201508245","html_url":"https://github.com/edx/bok-choy/pull/144#issuecomment-201508245","issue_url":"https://api.github.com/repos/edx/bok-choy/issues/144","id":201508245,"user":{"login":"robrap","id":14576445,"avatar_url":"https://avatars.githubusercontent.com/u/14576445?v=3","gravatar_id":"","url":"https://api.github.com/users/robrap","html_url":"https://github.com/robrap","followers_url":"https://api.github.com/users/robrap/followers","following_url":"https://api.github.com/users/robrap/following{/other_user}","gists_url":"https://api.github.com/users/robrap/gists{/gist_id}","starred_url":"https://api.github.com/users/robrap/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robrap/subscriptions","organizations_url":"https://api.github.com/users/robrap/orgs","repos_url":"https://api.github.com/users/robrap/repos","events_url":"https://api.github.com/users/robrap/events{/privacy}","received_events_url":"https://api.github.com/users/robrap/received_events","type":"User","site_admin":false},"created_at":"2016-03-25T21:15:35Z","updated_at":"2016-03-25T21:15:35Z","body":":+1:  with a comment to explain why this is needed (i.e. that this output is not the same as one would see when viewing page source)."}}