{"action":"created","issue":{"url":"https://api.github.com/repos/cf-tm-bot/identity/issues/120","repository_url":"https://api.github.com/repos/cf-tm-bot/identity","labels_url":"https://api.github.com/repos/cf-tm-bot/identity/issues/120/labels{/name}","comments_url":"https://api.github.com/repos/cf-tm-bot/identity/issues/120/comments","events_url":"https://api.github.com/repos/cf-tm-bot/identity/issues/120/events","html_url":"https://github.com/cf-tm-bot/identity/issues/120","id":176104084,"number":120,"title":"cloudfoundry/uaa #356: Invalid encoding char %00 causes information leak on postgres queries - Story Id: 119108571","user":{"login":"cf-tm-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-tm-bot","html_url":"https://github.com/cf-tm-bot","followers_url":"https://api.github.com/users/cf-tm-bot/followers","following_url":"https://api.github.com/users/cf-tm-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-tm-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-tm-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-tm-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-tm-bot/orgs","repos_url":"https://api.github.com/users/cf-tm-bot/repos","events_url":"https://api.github.com/users/cf-tm-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-tm-bot/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cf-tm-bot/identity/labels/bug","name":"bug","color":"ee0701"},{"url":"https://api.github.com/repos/cf-tm-bot/identity/labels/finished","name":"finished","color":"172c51"},{"url":"https://api.github.com/repos/cf-tm-bot/identity/labels/github-issue","name":"github-issue","color":"ededed"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-09T20:38:03Z","updated_at":"2016-09-15T14:20:15Z","closed_at":null,"body":"[Github Issue #356](https://github.com/cloudfoundry/uaa/issues/356)\n\n>At least with the /uaa/oauth/authorize endpoint, but probably others, you can include an invalid %00 encoding parameter and the resulting exception from postgres reveals information about the database. For example:\n>\n>Request:\n>\n>http://localhost/uaa/oauth/authorize?client_id=%00\n>\n>Response:\n>\n><?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?><error errorCode=\"0\" httpStatusCode=\"500\"><details><detail>exception: ...(message has been trimmed)\n\nFiled by [@mikeroda](http://github.com/mikeroda)\n\n---\n\nMirrors: [story 119108571](https://www.pivotaltracker.com/story/show/119108571) submitted on May 6, 2016 UTC\n- **Requester**: Claire Laurence\n- **Owners**: Filip Hanik\n- **Estimate**: 0.0"},"comment":{"url":"https://api.github.com/repos/cf-tm-bot/identity/issues/comments/247342037","html_url":"https://github.com/cf-tm-bot/identity/issues/120#issuecomment-247342037","issue_url":"https://api.github.com/repos/cf-tm-bot/identity/issues/120","id":247342037,"user":{"login":"cf-tm-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-tm-bot","html_url":"https://github.com/cf-tm-bot","followers_url":"https://api.github.com/users/cf-tm-bot/followers","following_url":"https://api.github.com/users/cf-tm-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-tm-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-tm-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-tm-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-tm-bot/orgs","repos_url":"https://api.github.com/users/cf-tm-bot/repos","events_url":"https://api.github.com/users/cf-tm-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-tm-bot/received_events","type":"User","site_admin":false},"created_at":"2016-09-15T14:20:15Z","updated_at":"2016-09-15T14:20:15Z","body":"Kevin Huang [commented](https://www.pivotaltracker.com/n/projects/997278/stories/119108571/comments/149296757) on Sep 12, 2016, 10.22 PM UTC:\n\nReproduce and identify version\n\n<!--\nComment Id: 149296757\n-->"}}
{"actor":{"display_login":"cf-tm-bot"}}