{"action":"closed","issue":{"url":"https://api.github.com/repos/icpc-live/autoanalyst/issues/17","repository_url":"https://api.github.com/repos/icpc-live/autoanalyst","labels_url":"https://api.github.com/repos/icpc-live/autoanalyst/issues/17/labels{/name}","comments_url":"https://api.github.com/repos/icpc-live/autoanalyst/issues/17/comments","events_url":"https://api.github.com/repos/icpc-live/autoanalyst/issues/17/events","html_url":"https://github.com/icpc-live/autoanalyst/issues/17","id":154984846,"number":17,"title":"iCAT should escape strings","user":{"login":"sjoqvist","id":1169231,"avatar_url":"https://avatars.githubusercontent.com/u/1169231?v=3","gravatar_id":"","url":"https://api.github.com/users/sjoqvist","html_url":"https://github.com/sjoqvist","followers_url":"https://api.github.com/users/sjoqvist/followers","following_url":"https://api.github.com/users/sjoqvist/following{/other_user}","gists_url":"https://api.github.com/users/sjoqvist/gists{/gist_id}","starred_url":"https://api.github.com/users/sjoqvist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sjoqvist/subscriptions","organizations_url":"https://api.github.com/users/sjoqvist/orgs","repos_url":"https://api.github.com/users/sjoqvist/repos","events_url":"https://api.github.com/users/sjoqvist/events{/privacy}","received_events_url":"https://api.github.com/users/sjoqvist/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/icpc-live/autoanalyst/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/icpc-live/autoanalyst/labels/iCAT","name":"iCAT","color":"207de5"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-05-16T08:37:41Z","updated_at":"2016-05-16T09:07:39Z","closed_at":"2016-05-16T09:07:39Z","body":"iCAT allows arbitrary scripts to be executed, since it doesn't escape HTML code.\r\n\r\nSteps to reproduce:\r\n\r\n1. Post the message `<script>$(document).mousemove(function(e){$(\"body\").css(\"background-color\", \"rgb(255,\"+Math.floor(e.pageX/$(document).width()*256)+\",\"+Math.floor(e.pageY/$(document).height()*256)+\")\");});</script>`\r\n2. Play around on the page with the mouse.\r\n\r\nNote that the solution should escape the _output_, **not** the input."}}