{"action":"closed","issue":{"url":"https://api.github.com/repos/arachnys/cabot/issues/231","repository_url":"https://api.github.com/repos/arachnys/cabot","labels_url":"https://api.github.com/repos/arachnys/cabot/issues/231/labels{/name}","comments_url":"https://api.github.com/repos/arachnys/cabot/issues/231/comments","events_url":"https://api.github.com/repos/arachnys/cabot/issues/231/events","html_url":"https://github.com/arachnys/cabot/issues/231","id":89262675,"number":231,"title":"`raw_data` is not escaped correctly when included in HTML (potential XSS)","user":{"login":"JordanMilne","id":278982,"avatar_url":"https://avatars.githubusercontent.com/u/278982?v=3","gravatar_id":"","url":"https://api.github.com/users/JordanMilne","html_url":"https://github.com/JordanMilne","followers_url":"https://api.github.com/users/JordanMilne/followers","following_url":"https://api.github.com/users/JordanMilne/following{/other_user}","gists_url":"https://api.github.com/users/JordanMilne/gists{/gist_id}","starred_url":"https://api.github.com/users/JordanMilne/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JordanMilne/subscriptions","organizations_url":"https://api.github.com/users/JordanMilne/orgs","repos_url":"https://api.github.com/users/JordanMilne/repos","events_url":"https://api.github.com/users/JordanMilne/events{/privacy}","received_events_url":"https://api.github.com/users/JordanMilne/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-18T11:05:15Z","updated_at":"2016-03-31T17:14:05Z","closed_at":"2016-03-31T17:14:05Z","body":"See https://github.com/arachnys/cabot/blob/a03450507f8cabd44d4c7120d1bd6cde7ee3f4c5/cabot/templates/cabotapp/statuscheckresult_detail.html#L34. Since [`raw_data` contains data that may be partially user-controller](https://github.com/arachnys/cabot/blob/a03450507f8cabd44d4c7120d1bd6cde7ee3f4c5/cabot/cabotapp/models.py#L717), XSS may be possible.\r\n\r\nSimple repro: Add an HTTP watch on http://saynotolinux.com/tests/cabot/escaping.txt with a text match on \"somethingelse\". Upon the first check failure, navigate to the page for that check and an `alert()` box will be shown.\r\n\r\nEasy way around that, only embed `raw_data` in the JS if it actually contains JSON. You should also guard against JSON containing embedded `</script>` tags ([like this](http://saynotolinux.com/tests/cabot/escaping.json)) by replacing `<` and `>` with their unicode escape equivalents (`\\u003C` and `\\u003E` respectively) before running the json through `|safe`."}}