{"action":"created","issue":{"url":"https://api.github.com/repos/18F/calc/issues/1118","repository_url":"https://api.github.com/repos/18F/calc","labels_url":"https://api.github.com/repos/18F/calc/issues/1118/labels{/name}","comments_url":"https://api.github.com/repos/18F/calc/issues/1118/comments","events_url":"https://api.github.com/repos/18F/calc/issues/1118/events","html_url":"https://github.com/18F/calc/issues/1118","id":195822085,"number":1118,"title":"Stored XSS vulnerability in data explorer autocomplete","user":{"login":"toolness","id":124687,"avatar_url":"https://avatars.githubusercontent.com/u/124687?v=3","gravatar_id":"","url":"https://api.github.com/users/toolness","html_url":"https://github.com/toolness","followers_url":"https://api.github.com/users/toolness/followers","following_url":"https://api.github.com/users/toolness/following{/other_user}","gists_url":"https://api.github.com/users/toolness/gists{/gist_id}","starred_url":"https://api.github.com/users/toolness/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/toolness/subscriptions","organizations_url":"https://api.github.com/users/toolness/orgs","repos_url":"https://api.github.com/users/toolness/repos","events_url":"https://api.github.com/users/toolness/events{/privacy}","received_events_url":"https://api.github.com/users/toolness/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-12-15T14:41:06Z","updated_at":"2016-12-15T16:12:00Z","closed_at":null,"body":"If a labor category contains any HTML, including script tags, it's inserted verbatim into the autocomplete suggestions popup. It's only really exploitable by the folks adding data to CALC, I guess."},"comment":{"url":"https://api.github.com/repos/18F/calc/issues/comments/267367952","html_url":"https://github.com/18F/calc/issues/1118#issuecomment-267367952","issue_url":"https://api.github.com/repos/18F/calc/issues/1118","id":267367952,"user":{"login":"toolness","id":124687,"avatar_url":"https://avatars.githubusercontent.com/u/124687?v=3","gravatar_id":"","url":"https://api.github.com/users/toolness","html_url":"https://github.com/toolness","followers_url":"https://api.github.com/users/toolness/followers","following_url":"https://api.github.com/users/toolness/following{/other_user}","gists_url":"https://api.github.com/users/toolness/gists{/gist_id}","starred_url":"https://api.github.com/users/toolness/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/toolness/subscriptions","organizations_url":"https://api.github.com/users/toolness/orgs","repos_url":"https://api.github.com/users/toolness/repos","events_url":"https://api.github.com/users/toolness/events{/privacy}","received_events_url":"https://api.github.com/users/toolness/received_events","type":"User","site_admin":false},"created_at":"2016-12-15T16:12:00Z","updated_at":"2016-12-15T16:12:00Z","body":"Hmm, I don't think we really need to, but I guess an argument could be made for it. My main concern about cleaning it up at capture time is that we might accidentally \"clean out\" legitimate information. For instance, who knows if at some point a labor category in a price list appears as `Engineer <Senior>`; depending on our sanitization algorithm, we might strip out that `<Senior>` , which leaves us with less useful information.\r\n\r\nWhen creating a HTML editor at my old job, we stored unsanitized HTML in the database but always made sure to sanitize it on its way out if needed--that way we could continually tweak the sanitization algorithm without accidentally+permanently losing user data."}}
{"actor":{"display_login":"toolness"}}