{"action":"closed","issue":{"url":"https://api.github.com/repos/joemccann/dillinger/issues/160","repository_url":"https://api.github.com/repos/joemccann/dillinger","labels_url":"https://api.github.com/repos/joemccann/dillinger/issues/160/labels{/name}","comments_url":"https://api.github.com/repos/joemccann/dillinger/issues/160/comments","events_url":"https://api.github.com/repos/joemccann/dillinger/issues/160/events","html_url":"https://github.com/joemccann/dillinger/issues/160","id":31777835,"number":160,"title":"JavaScript is executed inside editor","user":{"login":"evancohen","id":1198365,"avatar_url":"https://avatars.githubusercontent.com/u/1198365?v=3","gravatar_id":"","url":"https://api.github.com/users/evancohen","html_url":"https://github.com/evancohen","followers_url":"https://api.github.com/users/evancohen/followers","following_url":"https://api.github.com/users/evancohen/following{/other_user}","gists_url":"https://api.github.com/users/evancohen/gists{/gist_id}","starred_url":"https://api.github.com/users/evancohen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evancohen/subscriptions","organizations_url":"https://api.github.com/users/evancohen/orgs","repos_url":"https://api.github.com/users/evancohen/repos","events_url":"https://api.github.com/users/evancohen/events{/privacy}","received_events_url":"https://api.github.com/users/evancohen/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2014-04-18T02:36:21Z","updated_at":"2016-05-09T07:50:59Z","closed_at":"2016-05-09T07:50:59Z","body":"There is no JavaScript filter in the markup. Any JavaScript that is entered into the editor is executed, for instance:\r\n```\r\n<script>alert(0)</script>\r\n```\r\n\r\nWhile it is not possible to hijack GitHub and DropBox sessions because they are HttpOnly, it's still something that should be looked at."}}