{"action":"created","issue":{"url":"https://api.github.com/repos/phetsims/scenery/issues/528","repository_url":"https://api.github.com/repos/phetsims/scenery","labels_url":"https://api.github.com/repos/phetsims/scenery/issues/528/labels{/name}","comments_url":"https://api.github.com/repos/phetsims/scenery/issues/528/comments","events_url":"https://api.github.com/repos/phetsims/scenery/issues/528/events","html_url":"https://github.com/phetsims/scenery/issues/528","id":138302964,"number":528,"title":"SubSupText asserts when running the xss (cross site scripting) string test","user":{"login":"jbphet","id":3082831,"avatar_url":"https://avatars.githubusercontent.com/u/3082831?v=3","gravatar_id":"","url":"https://api.github.com/users/jbphet","html_url":"https://github.com/jbphet","followers_url":"https://api.github.com/users/jbphet/followers","following_url":"https://api.github.com/users/jbphet/following{/other_user}","gists_url":"https://api.github.com/users/jbphet/gists{/gist_id}","starred_url":"https://api.github.com/users/jbphet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbphet/subscriptions","organizations_url":"https://api.github.com/users/jbphet/orgs","repos_url":"https://api.github.com/users/jbphet/repos","events_url":"https://api.github.com/users/jbphet/events{/privacy}","received_events_url":"https://api.github.com/users/jbphet/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/phetsims/scenery/labels/meeting:developer","name":"meeting:developer","color":"000000"}],"state":"open","locked":false,"assignee":{"login":"jonathanolson","id":480878,"avatar_url":"https://avatars.githubusercontent.com/u/480878?v=3","gravatar_id":"","url":"https://api.github.com/users/jonathanolson","html_url":"https://github.com/jonathanolson","followers_url":"https://api.github.com/users/jonathanolson/followers","following_url":"https://api.github.com/users/jonathanolson/following{/other_user}","gists_url":"https://api.github.com/users/jonathanolson/gists{/gist_id}","starred_url":"https://api.github.com/users/jonathanolson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonathanolson/subscriptions","organizations_url":"https://api.github.com/users/jonathanolson/orgs","repos_url":"https://api.github.com/users/jonathanolson/repos","events_url":"https://api.github.com/users/jonathanolson/events{/privacy}","received_events_url":"https://api.github.com/users/jonathanolson/received_events","type":"User","site_admin":false},"milestone":null,"comments":6,"created_at":"2016-03-03T21:33:08Z","updated_at":"2016-03-08T17:18:13Z","closed_at":null,"body":"This was originally noticed on Resistance in a Wire, see https://github.com/phetsims/resistance-in-a-wire/issues/72.  When testing with the query parameter ```stringTest=xss``` (for checking whether any vulnerabilities exist for cross site scripting), the code hits the following assertion in SubSupText:\r\n\r\n```\r\nassert && assert( matchString === '<sub>' || matchString === '<sup>'\r\n```\r\n\r\nWithout assertions enabled, the sim crashes in SubSupText due to undefined variables.\r\n\r\nI discussed this with @jonathanolson and he says that this doesn't mean that there actually is any sort of cross scripting vulnerability.  He suggested adding a workaround in SubSupText to detect the query parameter and substitute a different string, but I find this a bit distasteful.  Marking for the next dev meeting and we can decide what to do."},"comment":{"url":"https://api.github.com/repos/phetsims/scenery/issues/comments/193875457","html_url":"https://github.com/phetsims/scenery/issues/528#issuecomment-193875457","issue_url":"https://api.github.com/repos/phetsims/scenery/issues/528","id":193875457,"user":{"login":"samreid","id":679486,"avatar_url":"https://avatars.githubusercontent.com/u/679486?v=3","gravatar_id":"","url":"https://api.github.com/users/samreid","html_url":"https://github.com/samreid","followers_url":"https://api.github.com/users/samreid/followers","following_url":"https://api.github.com/users/samreid/following{/other_user}","gists_url":"https://api.github.com/users/samreid/gists{/gist_id}","starred_url":"https://api.github.com/users/samreid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/samreid/subscriptions","organizations_url":"https://api.github.com/users/samreid/orgs","repos_url":"https://api.github.com/users/samreid/repos","events_url":"https://api.github.com/users/samreid/events{/privacy}","received_events_url":"https://api.github.com/users/samreid/received_events","type":"User","site_admin":false},"created_at":"2016-03-08T17:18:13Z","updated_at":"2016-03-08T17:18:13Z","body":"@jonathanolson points out that the long term solution is to do server-side validation of the strings."}}