{"action":"created","issue":{"url":"https://api.github.com/repos/linkedin/dustjs/issues/740","repository_url":"https://api.github.com/repos/linkedin/dustjs","labels_url":"https://api.github.com/repos/linkedin/dustjs/issues/740/labels{/name}","comments_url":"https://api.github.com/repos/linkedin/dustjs/issues/740/comments","events_url":"https://api.github.com/repos/linkedin/dustjs/issues/740/events","html_url":"https://github.com/linkedin/dustjs/issues/740","id":167485963,"number":740,"title":"XSS vulnerability","user":{"login":"dhruvgognaa","id":6799630,"avatar_url":"https://avatars.githubusercontent.com/u/6799630?v=3","gravatar_id":"","url":"https://api.github.com/users/dhruvgognaa","html_url":"https://github.com/dhruvgognaa","followers_url":"https://api.github.com/users/dhruvgognaa/followers","following_url":"https://api.github.com/users/dhruvgognaa/following{/other_user}","gists_url":"https://api.github.com/users/dhruvgognaa/gists{/gist_id}","starred_url":"https://api.github.com/users/dhruvgognaa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dhruvgognaa/subscriptions","organizations_url":"https://api.github.com/users/dhruvgognaa/orgs","repos_url":"https://api.github.com/users/dhruvgognaa/repos","events_url":"https://api.github.com/users/dhruvgognaa/events{/privacy}","received_events_url":"https://api.github.com/users/dhruvgognaa/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-07-25T23:04:20Z","updated_at":"2016-07-26T16:43:14Z","closed_at":null,"body":"While playing around with the filters on http://www.dustjs.com/docs/syntax/ under \"{reference}\" section, I noticed that if I change the value of \"markup\" to `<img` src=x onerror=alert(125)>`, the alert box pops up, and none of the filters (s, j, h) resolve the issue (Sorry it even came to hit and trial to see if I was missing anything on my end). Not sure if the team is aware of the issue, but wanted to put out there\r\n\r\nDust template:\r\n{name} is a valid Dust reference.{~n}\r\n{0name} is not a valid Dust reference.{~n}\r\n{.name} is a valid Dust reference.{~n}\r\n{.} is a valid dust reference.{~n}\r\n{markup|h}: HTML is escaped by default.\r\n\r\nData:\r\n{\r\n  \"name\": \"name\",\r\n  \"0name\": \"0name\",\r\n  \"markup\": \"<img src=x onerror=alert(125)>\"\r\n}\r\n\r\nCompiled Dust:\r\n(function(dust){dust.register(\"reference\",body_0);function body_0(chk,ctx){return chk.f(ctx.get([\"name\"], false),ctx,\"h\").w(\" is a valid Dust reference.\\n{0name} is not a valid Dust reference.\\n\").f(ctx.getPath(true, [\"name\"]),ctx,\"h\").w(\" is a valid Dust reference.\\n\").f(ctx.getPath(true, []),ctx,\"h\").w(\" is a valid dust reference.\\n\").f(ctx.get([\"markup\"], false),ctx,\"h\",[\"h\"]).w(\": HTML is escaped by default.\");}body_0.__dustBody=!0;return body_0}(dust));\r\n\r\nOutput:\r\nname is a valid Dust reference.\r\n{0name} is not a valid Dust reference.\r\nname is a valid Dust reference.\r\n[object Object] is a valid dust reference.\r\n: HTML is escaped by default."},"comment":{"url":"https://api.github.com/repos/linkedin/dustjs/issues/comments/235328848","html_url":"https://github.com/linkedin/dustjs/issues/740#issuecomment-235328848","issue_url":"https://api.github.com/repos/linkedin/dustjs/issues/740","id":235328848,"user":{"login":"sethkinast","id":1399532,"avatar_url":"https://avatars.githubusercontent.com/u/1399532?v=3","gravatar_id":"","url":"https://api.github.com/users/sethkinast","html_url":"https://github.com/sethkinast","followers_url":"https://api.github.com/users/sethkinast/followers","following_url":"https://api.github.com/users/sethkinast/following{/other_user}","gists_url":"https://api.github.com/users/sethkinast/gists{/gist_id}","starred_url":"https://api.github.com/users/sethkinast/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sethkinast/subscriptions","organizations_url":"https://api.github.com/users/sethkinast/orgs","repos_url":"https://api.github.com/users/sethkinast/repos","events_url":"https://api.github.com/users/sethkinast/events{/privacy}","received_events_url":"https://api.github.com/users/sethkinast/received_events","type":"User","site_admin":false},"created_at":"2016-07-26T16:43:14Z","updated_at":"2016-07-26T16:43:14Z","body":"Yeah I think it's definitely just the component, that was why I thought you\nmight know best how to handle it. It's just a self xss so not critical, no\nworries\n\nOn Tue, Jul 26, 2016, 9:33 AM Steven <notifications@github.com> wrote:\n\n> As far as I can tell, there is an error in how the demo web component is\n> escaping HTML in the JSON. I don't believe this is an XSS hole in Dust\n> itself. I'll keep researching.\n>\n> —\n> You are receiving this because you commented.\n>\n>\n> Reply to this email directly, view it on GitHub\n> <https://github.com/linkedin/dustjs/issues/740#issuecomment-235325894>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/ABVa7K_IA0jXe1MVM_09BGTukmVmUF_Rks5qZjbLgaJpZM4JUol9>\n> .\n>\n"}}
{"actor":{"display_login":"sethkinast"}}