{"action":"created","issue":{"url":"https://api.github.com/repos/ohler55/ox/issues/149","repository_url":"https://api.github.com/repos/ohler55/ox","labels_url":"https://api.github.com/repos/ohler55/ox/issues/149/labels{/name}","comments_url":"https://api.github.com/repos/ohler55/ox/issues/149/comments","events_url":"https://api.github.com/repos/ohler55/ox/issues/149/events","html_url":"https://github.com/ohler55/ox/issues/149","id":169360572,"number":149,"title":"Escaping of attributes","user":{"login":"groe","id":515293,"avatar_url":"https://avatars.githubusercontent.com/u/515293?v=3","gravatar_id":"","url":"https://api.github.com/users/groe","html_url":"https://github.com/groe","followers_url":"https://api.github.com/users/groe/followers","following_url":"https://api.github.com/users/groe/following{/other_user}","gists_url":"https://api.github.com/users/groe/gists{/gist_id}","starred_url":"https://api.github.com/users/groe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/groe/subscriptions","organizations_url":"https://api.github.com/users/groe/orgs","repos_url":"https://api.github.com/users/groe/repos","events_url":"https://api.github.com/users/groe/events{/privacy}","received_events_url":"https://api.github.com/users/groe/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-04T12:17:43Z","updated_at":"2016-08-04T13:46:15Z","closed_at":null,"body":"I have noticed that `Ox::Builder#element(name, attributes)` does not escape attribute values.\r\n\r\n```ruby\r\nbuilder = Ox::Builder.new\r\nbuilder.element(:div, title: '\"><script>alert(\"hacked\");</script>')\r\nbuilder.pop\r\nbuilder.to_s\r\n# <div title=\"\"><script>alert(\"hacked\");</script>\"/>\r\n```\r\n\r\nIs this a bug or a deliberate design decision (meaning users of ox should take care of escaping everything before passing it to the builder)?\r\n\r\nThe `Ox::Builder#text(str)` method seems to escape the `str` passed to it."},"comment":{"url":"https://api.github.com/repos/ohler55/ox/issues/comments/237557351","html_url":"https://github.com/ohler55/ox/issues/149#issuecomment-237557351","issue_url":"https://api.github.com/repos/ohler55/ox/issues/149","id":237557351,"user":{"login":"ohler55","id":118856,"avatar_url":"https://avatars.githubusercontent.com/u/118856?v=3","gravatar_id":"","url":"https://api.github.com/users/ohler55","html_url":"https://github.com/ohler55","followers_url":"https://api.github.com/users/ohler55/followers","following_url":"https://api.github.com/users/ohler55/following{/other_user}","gists_url":"https://api.github.com/users/ohler55/gists{/gist_id}","starred_url":"https://api.github.com/users/ohler55/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ohler55/subscriptions","organizations_url":"https://api.github.com/users/ohler55/orgs","repos_url":"https://api.github.com/users/ohler55/repos","events_url":"https://api.github.com/users/ohler55/events{/privacy}","received_events_url":"https://api.github.com/users/ohler55/received_events","type":"User","site_admin":false},"created_at":"2016-08-04T13:46:15Z","updated_at":"2016-08-04T13:46:15Z","body":"The attribute should be escaped. It is a bug. I'll get it fixed."}}
{"actor":{"display_login":"ohler55"}}