{"action":"created","comment":{"url":"https://api.github.com/repos/opf/openproject/pulls/comments/67188132","id":67188132,"diff_hunk":"@@ -95,6 +95,9 @@ gem 'rack-protection', git: 'https://github.com/finnlabs/rack-protection.git', r\n # https://github.com/kickstarter/rack-attack\n gem 'rack-attack'\n \n+# Patch Rails HTML whitelisting for Angular curly braces\n+gem 'rails-angular-xss', github: 'opf/rails-angular-xss'","path":"Gemfile","position":5,"original_position":5,"commit_id":"43599a9179fd8edf1b8b6b84ffcad9c9cc8c6609","original_commit_id":"43599a9179fd8edf1b8b6b84ffcad9c9cc8c6609","user":{"login":"ulferts","id":617519,"avatar_url":"https://avatars.githubusercontent.com/u/617519?v=3","gravatar_id":"","url":"https://api.github.com/users/ulferts","html_url":"https://github.com/ulferts","followers_url":"https://api.github.com/users/ulferts/followers","following_url":"https://api.github.com/users/ulferts/following{/other_user}","gists_url":"https://api.github.com/users/ulferts/gists{/gist_id}","starred_url":"https://api.github.com/users/ulferts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ulferts/subscriptions","organizations_url":"https://api.github.com/users/ulferts/orgs","repos_url":"https://api.github.com/users/ulferts/repos","events_url":"https://api.github.com/users/ulferts/events{/privacy}","received_events_url":"https://api.github.com/users/ulferts/received_events","type":"User","site_admin":false},"body":"That sounds like a long time :(","created_at":"2016-06-15T15:46:03Z","updated_at":"2016-06-15T15:46:03Z","html_url":"https://github.com/opf/openproject/pull/4536#discussion_r67188132","pull_request_url":"https://api.github.com/repos/opf/openproject/pulls/4536","_links":{"self":{"href":"https://api.github.com/repos/opf/openproject/pulls/comments/67188132"},"html":{"href":"https://github.com/opf/openproject/pull/4536#discussion_r67188132"},"pull_request":{"href":"https://api.github.com/repos/opf/openproject/pulls/4536"}}},"pull_request":{"url":"https://api.github.com/repos/opf/openproject/pulls/4536","id":73805002,"html_url":"https://github.com/opf/openproject/pull/4536","diff_url":"https://github.com/opf/openproject/pull/4536.diff","patch_url":"https://github.com/opf/openproject/pull/4536.patch","issue_url":"https://api.github.com/repos/opf/openproject/issues/4536","number":4536,"state":"open","locked":false,"title":"[23073] Add Angular expression escaping","user":{"login":"oliverguenther","id":459462,"avatar_url":"https://avatars.githubusercontent.com/u/459462?v=3","gravatar_id":"","url":"https://api.github.com/users/oliverguenther","html_url":"https://github.com/oliverguenther","followers_url":"https://api.github.com/users/oliverguenther/followers","following_url":"https://api.github.com/users/oliverguenther/following{/other_user}","gists_url":"https://api.github.com/users/oliverguenther/gists{/gist_id}","starred_url":"https://api.github.com/users/oliverguenther/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oliverguenther/subscriptions","organizations_url":"https://api.github.com/users/oliverguenther/orgs","repos_url":"https://api.github.com/users/oliverguenther/repos","events_url":"https://api.github.com/users/oliverguenther/events{/privacy}","received_events_url":"https://api.github.com/users/oliverguenther/received_events","type":"User","site_admin":false},"body":"This PR adds `rails-angular-xss`, our gem forked from `angular_xss`for Rails 4.2.\r\n\r\nThe gem patches Rails XSS protection methods with a replacement of `{{`\r\nstrings with `{{ DOUBLE_LEFT_CURLY_BRACE }} `.\r\n\r\n`DOUBLE_LEFT_CURLY_BRACE` is defined by Angular to return `{{`, so we\r\nactually do execute the interpolation, but only to return the original\r\nstring.\r\n\r\nMore information:\r\n\r\nhttps://github.com/opf/rails-angular-xss\r\nangular/angular.js#5601","created_at":"2016-06-14T20:08:46Z","updated_at":"2016-06-15T15:46:03Z","closed_at":null,"merged_at":null,"merge_commit_sha":"7772e4f01259eef11bd334c8bbfaf3e1c9d8ca04","assignee":null,"milestone":{"url":"https://api.github.com/repos/opf/openproject/milestones/3","html_url":"https://github.com/opf/openproject/milestones/5.0.x","labels_url":"https://api.github.com/repos/opf/openproject/milestones/3/labels","id":1104474,"number":3,"title":"5.0.x","description":"5.0.x maintenance releases","creator":{"login":"myabc","id":755,"avatar_url":"https://avatars.githubusercontent.com/u/755?v=3","gravatar_id":"","url":"https://api.github.com/users/myabc","html_url":"https://github.com/myabc","followers_url":"https://api.github.com/users/myabc/followers","following_url":"https://api.github.com/users/myabc/following{/other_user}","gists_url":"https://api.github.com/users/myabc/gists{/gist_id}","starred_url":"https://api.github.com/users/myabc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/myabc/subscriptions","organizations_url":"https://api.github.com/users/myabc/orgs","repos_url":"https://api.github.com/users/myabc/repos","events_url":"https://api.github.com/users/myabc/events{/privacy}","received_events_url":"https://api.github.com/users/myabc/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":222,"state":"open","created_at":"2015-05-11T10:04:28Z","updated_at":"2016-06-15T09:05:32Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/opf/openproject/pulls/4536/commits","review_comments_url":"https://api.github.com/repos/opf/openproject/pulls/4536/comments","review_comment_url":"https://api.github.com/repos/opf/openproject/pulls/comments{/number}","comments_url":"https://api.github.com/repos/opf/openproject/issues/4536/comments","statuses_url":"https://api.github.com/repos/opf/openproject/statuses/43599a9179fd8edf1b8b6b84ffcad9c9cc8c6609","head":{"label":"oliverguenther:fix/23073/template-injection","ref":"fix/23073/template-injection","sha":"43599a9179fd8edf1b8b6b84ffcad9c9cc8c6609","user":{"login":"oliverguenther","id":459462,"avatar_url":"https://avatars.githubusercontent.com/u/459462?v=3","gravatar_id":"","url":"https://api.github.com/users/oliverguenther","html_url":"https://github.com/oliverguenther","followers_url":"https://api.github.com/users/oliverguenther/followers","following_url":"https://api.github.com/users/oliverguenther/following{/other_user}","gists_url":"https://api.github.com/users/oliverguenther/gists{/gist_id}","starred_url":"https://api.github.com/users/oliverguenther/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oliverguenther/subscriptions","organizations_url":"https://api.github.com/users/oliverguenther/orgs","repos_url":"https://api.github.com/users/oliverguenther/repos","events_url":"https://api.github.com/users/oliverguenther/events{/privacy}","received_events_url":"https://api.github.com/users/oliverguenther/received_events","type":"User","site_admin":false},"repo":{"id":33988921,"name":"openproject","full_name":"oliverguenther/openproject","owner":{"login":"oliverguenther","id":459462,"avatar_url":"https://avatars.githubusercontent.com/u/459462?v=3","gravatar_id":"","url":"https://api.github.com/users/oliverguenther","html_url":"https://github.com/oliverguenther","followers_url":"https://api.github.com/users/oliverguenther/followers","following_url":"https://api.github.com/users/oliverguenther/following{/other_user}","gists_url":"https://api.github.com/users/oliverguenther/gists{/gist_id}","starred_url":"https://api.github.com/users/oliverguenther/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oliverguenther/subscriptions","organizations_url":"https://api.github.com/users/oliverguenther/orgs","repos_url":"https://api.github.com/users/oliverguenther/repos","events_url":"https://api.github.com/users/oliverguenther/events{/privacy}","received_events_url":"https://api.github.com/users/oliverguenther/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/oliverguenther/openproject","description":"OpenProject is a web-based project management system built on Ruby on Rails","fork":true,"url":"https://api.github.com/repos/oliverguenther/openproject","forks_url":"https://api.github.com/repos/oliverguenther/openproject/forks","keys_url":"https://api.github.com/repos/oliverguenther/openproject/keys{/key_id}","collaborators_url":"https://api.github.com/repos/oliverguenther/openproject/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/oliverguenther/openproject/teams","hooks_url":"https://api.github.com/repos/oliverguenther/openproject/hooks","issue_events_url":"https://api.github.com/repos/oliverguenther/openproject/issues/events{/number}","events_url":"https://api.github.com/repos/oliverguenther/openproject/events","assignees_url":"https://api.github.com/repos/oliverguenther/openproject/assignees{/user}","branches_url":"https://api.github.com/repos/oliverguenther/openproject/branches{/branch}","tags_url":"https://api.github.com/repos/oliverguenther/openproject/tags","blobs_url":"https://api.github.com/repos/oliverguenther/openproject/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/oliverguenther/openproject/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/oliverguenther/openproject/git/refs{/sha}","trees_url":"https://api.github.com/repos/oliverguenther/openproject/git/trees{/sha}","statuses_url":"https://api.github.com/repos/oliverguenther/openproject/statuses/{sha}","languages_url":"https://api.github.com/repos/oliverguenther/openproject/languages","stargazers_url":"https://api.github.com/repos/oliverguenther/openproject/stargazers","contributors_url":"https://api.github.com/repos/oliverguenther/openproject/contributors","subscribers_url":"https://api.github.com/repos/oliverguenther/openproject/subscribers","subscription_url":"https://api.github.com/repos/oliverguenther/openproject/subscription","commits_url":"https://api.github.com/repos/oliverguenther/openproject/commits{/sha}","git_commits_url":"https://api.github.com/repos/oliverguenther/openproject/git/commits{/sha}","comments_url":"https://api.github.com/repos/oliverguenther/openproject/comments{/number}","issue_comment_url":"https://api.github.com/repos/oliverguenther/openproject/issues/comments{/number}","contents_url":"https://api.github.com/repos/oliverguenther/openproject/contents/{+path}","compare_url":"https://api.github.com/repos/oliverguenther/openproject/compare/{base}...{head}","merges_url":"https://api.github.com/repos/oliverguenther/openproject/merges","archive_url":"https://api.github.com/repos/oliverguenther/openproject/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/oliverguenther/openproject/downloads","issues_url":"https://api.github.com/repos/oliverguenther/openproject/issues{/number}","pulls_url":"https://api.github.com/repos/oliverguenther/openproject/pulls{/number}","milestones_url":"https://api.github.com/repos/oliverguenther/openproject/milestones{/number}","notifications_url":"https://api.github.com/repos/oliverguenther/openproject/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/oliverguenther/openproject/labels{/name}","releases_url":"https://api.github.com/repos/oliverguenther/openproject/releases{/id}","deployments_url":"https://api.github.com/repos/oliverguenther/openproject/deployments","created_at":"2015-04-15T11:02:49Z","updated_at":"2016-03-11T13:08:54Z","pushed_at":"2016-06-15T12:30:01Z","git_url":"git://github.com/oliverguenther/openproject.git","ssh_url":"git@github.com:oliverguenther/openproject.git","clone_url":"https://github.com/oliverguenther/openproject.git","svn_url":"https://github.com/oliverguenther/openproject","homepage":"https://www.openproject.org","size":77416,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"dev"}},"base":{"label":"opf:release/5.0","ref":"release/5.0","sha":"7faffc9d64ab4bb9c0436fa0725297987b6b3dc6","user":{"login":"opf","id":1756674,"avatar_url":"https://avatars.githubusercontent.com/u/1756674?v=3","gravatar_id":"","url":"https://api.github.com/users/opf","html_url":"https://github.com/opf","followers_url":"https://api.github.com/users/opf/followers","following_url":"https://api.github.com/users/opf/following{/other_user}","gists_url":"https://api.github.com/users/opf/gists{/gist_id}","starred_url":"https://api.github.com/users/opf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/opf/subscriptions","organizations_url":"https://api.github.com/users/opf/orgs","repos_url":"https://api.github.com/users/opf/repos","events_url":"https://api.github.com/users/opf/events{/privacy}","received_events_url":"https://api.github.com/users/opf/received_events","type":"Organization","site_admin":false},"repo":{"id":6899875,"name":"openproject","full_name":"opf/openproject","owner":{"login":"opf","id":1756674,"avatar_url":"https://avatars.githubusercontent.com/u/1756674?v=3","gravatar_id":"","url":"https://api.github.com/users/opf","html_url":"https://github.com/opf","followers_url":"https://api.github.com/users/opf/followers","following_url":"https://api.github.com/users/opf/following{/other_user}","gists_url":"https://api.github.com/users/opf/gists{/gist_id}","starred_url":"https://api.github.com/users/opf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/opf/subscriptions","organizations_url":"https://api.github.com/users/opf/orgs","repos_url":"https://api.github.com/users/opf/repos","events_url":"https://api.github.com/users/opf/events{/privacy}","received_events_url":"https://api.github.com/users/opf/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/opf/openproject","description":"OpenProject is a web-based project management system built on Ruby on Rails","fork":false,"url":"https://api.github.com/repos/opf/openproject","forks_url":"https://api.github.com/repos/opf/openproject/forks","keys_url":"https://api.github.com/repos/opf/openproject/keys{/key_id}","collaborators_url":"https://api.github.com/repos/opf/openproject/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/opf/openproject/teams","hooks_url":"https://api.github.com/repos/opf/openproject/hooks","issue_events_url":"https://api.github.com/repos/opf/openproject/issues/events{/number}","events_url":"https://api.github.com/repos/opf/openproject/events","assignees_url":"https://api.github.com/repos/opf/openproject/assignees{/user}","branches_url":"https://api.github.com/repos/opf/openproject/branches{/branch}","tags_url":"https://api.github.com/repos/opf/openproject/tags","blobs_url":"https://api.github.com/repos/opf/openproject/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/opf/openproject/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/opf/openproject/git/refs{/sha}","trees_url":"https://api.github.com/repos/opf/openproject/git/trees{/sha}","statuses_url":"https://api.github.com/repos/opf/openproject/statuses/{sha}","languages_url":"https://api.github.com/repos/opf/openproject/languages","stargazers_url":"https://api.github.com/repos/opf/openproject/stargazers","contributors_url":"https://api.github.com/repos/opf/openproject/contributors","subscribers_url":"https://api.github.com/repos/opf/openproject/subscribers","subscription_url":"https://api.github.com/repos/opf/openproject/subscription","commits_url":"https://api.github.com/repos/opf/openproject/commits{/sha}","git_commits_url":"https://api.github.com/repos/opf/openproject/git/commits{/sha}","comments_url":"https://api.github.com/repos/opf/openproject/comments{/number}","issue_comment_url":"https://api.github.com/repos/opf/openproject/issues/comments{/number}","contents_url":"https://api.github.com/repos/opf/openproject/contents/{+path}","compare_url":"https://api.github.com/repos/opf/openproject/compare/{base}...{head}","merges_url":"https://api.github.com/repos/opf/openproject/merges","archive_url":"https://api.github.com/repos/opf/openproject/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/opf/openproject/downloads","issues_url":"https://api.github.com/repos/opf/openproject/issues{/number}","pulls_url":"https://api.github.com/repos/opf/openproject/pulls{/number}","milestones_url":"https://api.github.com/repos/opf/openproject/milestones{/number}","notifications_url":"https://api.github.com/repos/opf/openproject/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/opf/openproject/labels{/name}","releases_url":"https://api.github.com/repos/opf/openproject/releases{/id}","deployments_url":"https://api.github.com/repos/opf/openproject/deployments","created_at":"2012-11-28T09:59:11Z","updated_at":"2016-06-15T11:21:57Z","pushed_at":"2016-06-15T14:00:18Z","git_url":"git://github.com/opf/openproject.git","ssh_url":"git@github.com:opf/openproject.git","clone_url":"https://github.com/opf/openproject.git","svn_url":"https://github.com/opf/openproject","homepage":"https://www.openproject.org","size":183183,"stargazers_count":1053,"watchers_count":1053,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":399,"mirror_url":null,"open_issues_count":13,"forks":399,"open_issues":13,"watchers":1053,"default_branch":"dev"}},"_links":{"self":{"href":"https://api.github.com/repos/opf/openproject/pulls/4536"},"html":{"href":"https://github.com/opf/openproject/pull/4536"},"issue":{"href":"https://api.github.com/repos/opf/openproject/issues/4536"},"comments":{"href":"https://api.github.com/repos/opf/openproject/issues/4536/comments"},"review_comments":{"href":"https://api.github.com/repos/opf/openproject/pulls/4536/comments"},"review_comment":{"href":"https://api.github.com/repos/opf/openproject/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/opf/openproject/pulls/4536/commits"},"statuses":{"href":"https://api.github.com/repos/opf/openproject/statuses/43599a9179fd8edf1b8b6b84ffcad9c9cc8c6609"}}}}
{"actor":{"display_login":"ulferts"}}