{"action":"created","issue":{"url":"https://api.github.com/repos/pallets/werkzeug/issues/1028","repository_url":"https://api.github.com/repos/pallets/werkzeug","labels_url":"https://api.github.com/repos/pallets/werkzeug/issues/1028/labels{/name}","comments_url":"https://api.github.com/repos/pallets/werkzeug/issues/1028/comments","events_url":"https://api.github.com/repos/pallets/werkzeug/issues/1028/events","html_url":"https://github.com/pallets/werkzeug/pull/1028","id":186346395,"number":1028,"title":"Limit the size of the PIN for the debug interface.","user":{"login":"romeojulietthotel","id":20975463,"avatar_url":"https://avatars.githubusercontent.com/u/20975463?v=3","gravatar_id":"","url":"https://api.github.com/users/romeojulietthotel","html_url":"https://github.com/romeojulietthotel","followers_url":"https://api.github.com/users/romeojulietthotel/followers","following_url":"https://api.github.com/users/romeojulietthotel/following{/other_user}","gists_url":"https://api.github.com/users/romeojulietthotel/gists{/gist_id}","starred_url":"https://api.github.com/users/romeojulietthotel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/romeojulietthotel/subscriptions","organizations_url":"https://api.github.com/users/romeojulietthotel/orgs","repos_url":"https://api.github.com/users/romeojulietthotel/repos","events_url":"https://api.github.com/users/romeojulietthotel/events{/privacy}","received_events_url":"https://api.github.com/users/romeojulietthotel/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2016-10-31T17:31:09Z","updated_at":"2016-10-31T23:13:39Z","closed_at":"2016-10-31T22:10:21Z","pull_request":{"url":"https://api.github.com/repos/pallets/werkzeug/pulls/1028","html_url":"https://github.com/pallets/werkzeug/pull/1028","diff_url":"https://github.com/pallets/werkzeug/pull/1028.diff","patch_url":"https://github.com/pallets/werkzeug/pull/1028.patch"},"body":"I accidentally pasted an entire html page into the PIN field and it was allowed (but rejected). "},"comment":{"url":"https://api.github.com/repos/pallets/werkzeug/issues/comments/257447408","html_url":"https://github.com/pallets/werkzeug/pull/1028#issuecomment-257447408","issue_url":"https://api.github.com/repos/pallets/werkzeug/issues/1028","id":257447408,"user":{"login":"untitaker","id":837573,"avatar_url":"https://avatars.githubusercontent.com/u/837573?v=3","gravatar_id":"","url":"https://api.github.com/users/untitaker","html_url":"https://github.com/untitaker","followers_url":"https://api.github.com/users/untitaker/followers","following_url":"https://api.github.com/users/untitaker/following{/other_user}","gists_url":"https://api.github.com/users/untitaker/gists{/gist_id}","starred_url":"https://api.github.com/users/untitaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untitaker/subscriptions","organizations_url":"https://api.github.com/users/untitaker/orgs","repos_url":"https://api.github.com/users/untitaker/repos","events_url":"https://api.github.com/users/untitaker/events{/privacy}","received_events_url":"https://api.github.com/users/untitaker/received_events","type":"User","site_admin":false},"created_at":"2016-10-31T23:13:39Z","updated_at":"2016-10-31T23:13:39Z","body":">I entered an entire html page into the field and the data was accepted, of course it didn't match the PIN,\r\n\r\nGood.\r\n\r\n>and all that data is printed out into the terminal by the werkzeug server.\r\n\r\nFirst time you clearly state that we're dealing with an XSS. Length limit doesn't solve it.\r\n\r\n>Messy behavior at least.\r\n\r\nI agree.\r\n\r\n>And if security is not expected why even have a PIN at all\r\n\r\nSelf-XSS is not the same as remote code execution. It's the difference between shooting yourself and shooting somebody else. We don't really have to care about the former.\r\n\r\nDoS is also an entirely different beast but it's a completely unrelated thing which I mistakenly brought into the debate."}}
{"actor":{"display_login":"untitaker"}}