{"action":"created","issue":{"url":"https://api.github.com/repos/ceolter/ag-grid/issues/913","repository_url":"https://api.github.com/repos/ceolter/ag-grid","labels_url":"https://api.github.com/repos/ceolter/ag-grid/issues/913/labels{/name}","comments_url":"https://api.github.com/repos/ceolter/ag-grid/issues/913/comments","events_url":"https://api.github.com/repos/ceolter/ag-grid/issues/913/events","html_url":"https://github.com/ceolter/ag-grid/issues/913","id":155748403,"number":913,"title":"HTML injection vulnerability","user":{"login":"theodorejb","id":3053271,"avatar_url":"https://avatars.githubusercontent.com/u/3053271?v=3","gravatar_id":"","url":"https://api.github.com/users/theodorejb","html_url":"https://github.com/theodorejb","followers_url":"https://api.github.com/users/theodorejb/followers","following_url":"https://api.github.com/users/theodorejb/following{/other_user}","gists_url":"https://api.github.com/users/theodorejb/gists{/gist_id}","starred_url":"https://api.github.com/users/theodorejb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theodorejb/subscriptions","organizations_url":"https://api.github.com/users/theodorejb/orgs","repos_url":"https://api.github.com/users/theodorejb/repos","events_url":"https://api.github.com/users/theodorejb/events{/privacy}","received_events_url":"https://api.github.com/users/theodorejb/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2016-05-19T14:19:17Z","updated_at":"2016-06-09T07:37:38Z","closed_at":"2016-06-08T11:28:59Z","body":"I was very surprised to discover that ag-Grid does nothing to escape field values by default.\r\n\r\nWith a column definition like: `{headerName: \"Name\", field: \"name\"}` a user can enter a name such as `<span onclick=\"alert('hacked!')\">John Smith</span>` and effectively initiate a cross-site scripting attack.\r\n\r\nThe only time field values should not be escaped is if there is a a custom `cellRenderer` for the column.\r\n\r\nRelated: https://github.com/ceolter/ag-grid/issues/9#issuecomment-191623488"},"comment":{"url":"https://api.github.com/repos/ceolter/ag-grid/issues/comments/224821571","html_url":"https://github.com/ceolter/ag-grid/issues/913#issuecomment-224821571","issue_url":"https://api.github.com/repos/ceolter/ag-grid/issues/913","id":224821571,"user":{"login":"ceolter","id":6539563,"avatar_url":"https://avatars.githubusercontent.com/u/6539563?v=3","gravatar_id":"","url":"https://api.github.com/users/ceolter","html_url":"https://github.com/ceolter","followers_url":"https://api.github.com/users/ceolter/followers","following_url":"https://api.github.com/users/ceolter/following{/other_user}","gists_url":"https://api.github.com/users/ceolter/gists{/gist_id}","starred_url":"https://api.github.com/users/ceolter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ceolter/subscriptions","organizations_url":"https://api.github.com/users/ceolter/orgs","repos_url":"https://api.github.com/users/ceolter/repos","events_url":"https://api.github.com/users/ceolter/events{/privacy}","received_events_url":"https://api.github.com/users/ceolter/received_events","type":"User","site_admin":false},"created_at":"2016-06-09T07:37:38Z","updated_at":"2016-06-09T07:37:38Z","body":"valueGetter isn't used for rendering - the value is then either passed to cellRenderer or rendered by grid (which, as above, uses textContext now)"}}
{"actor":{"display_login":"ceolter"}}