{"action":"created","issue":{"url":"https://api.github.com/repos/minkphp/Mink/issues/677","repository_url":"https://api.github.com/repos/minkphp/Mink","labels_url":"https://api.github.com/repos/minkphp/Mink/issues/677/labels{/name}","comments_url":"https://api.github.com/repos/minkphp/Mink/issues/677/comments","events_url":"https://api.github.com/repos/minkphp/Mink/issues/677/events","html_url":"https://github.com/minkphp/Mink/pull/677","id":110691269,"number":677,"title":"Fix an instance of xss","user":{"login":"greggles","id":392568,"avatar_url":"https://avatars.githubusercontent.com/u/392568?v=3","gravatar_id":"","url":"https://api.github.com/users/greggles","html_url":"https://github.com/greggles","followers_url":"https://api.github.com/users/greggles/followers","following_url":"https://api.github.com/users/greggles/following{/other_user}","gists_url":"https://api.github.com/users/greggles/gists{/gist_id}","starred_url":"https://api.github.com/users/greggles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/greggles/subscriptions","organizations_url":"https://api.github.com/users/greggles/orgs","repos_url":"https://api.github.com/users/greggles/repos","events_url":"https://api.github.com/users/greggles/events{/privacy}","received_events_url":"https://api.github.com/users/greggles/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":30,"created_at":"2015-10-09T16:18:17Z","updated_at":"2016-03-09T14:00:44Z","closed_at":"2016-02-27T11:19:10Z","pull_request":{"url":"https://api.github.com/repos/minkphp/Mink/pulls/677","html_url":"https://github.com/minkphp/Mink/pull/677","diff_url":"https://github.com/minkphp/Mink/pull/677.diff","patch_url":"https://github.com/minkphp/Mink/pull/677.patch"},"body":"Hi,\r\n\r\nThere's an xss issue in https://github.com/minkphp/Mink/blob/master/driver-testsuite/web-fixtures/issue130.php\r\n\r\nThat issue was highlighted in an email to full disclosure at http://seclists.org/fulldisclosure/2015/Oct/42\r\n\r\nThe Drupal project attempts to solve this xss issue with an .htaccess file, but that's not very reliable. Another solution is to keep Mink code outside of the webroot, but that's not always possible on all servers.\r\n\r\nIt would be ideal, in my opinion, to just filter the text. \r\n\r\nI did a quick grep to look for other similar problems and it seems there are some:\r\n\r\n```\r\n ✗ grep -r echo . | grep \\$_\r\n./driver-testsuite/web-fixtures/advanced_form_post.php:echo str_replace('>', '', var_export($_POST, true)) . \"\\n\";\r\n./driver-testsuite/web-fixtures/advanced_form_post.php:    echo $_FILES['about']['name'] . \"\\n\";\r\n./driver-testsuite/web-fixtures/advanced_form_post.php:    echo file_get_contents($_FILES['about']['tmp_name']);\r\n./driver-testsuite/web-fixtures/basic_form_post.php:    <h1>Anket for <?php echo $_POST['first_name'] ?></h1>\r\n./driver-testsuite/web-fixtures/basic_form_post.php:    <span id=\"first\">Firstname: <?php echo $_POST['first_name'] ?></span>\r\n./driver-testsuite/web-fixtures/basic_form_post.php:    <span id=\"last\">Lastname: <?php echo $_POST['last_name'] ?></span>\r\n./driver-testsuite/web-fixtures/basic_get_form.php:        <?php echo isset($_GET['q']) && $_GET['q'] ? $_GET['q'] : 'No search query' ?>\r\n./driver-testsuite/web-fixtures/cookie_page2.php:    Previous cookie: <?php echo isset($_COOKIE['srvr_cookie']) ? $_COOKIE['srvr_cookie'] : 'NO'; ?>\r\n./driver-testsuite/web-fixtures/issue130.php:        echo '<strong>'.htmlspecialchars($_SERVER['HTTP_REFERER'], ENT_QUOTES, 'UTF-8');).'</strong>';\r\n./driver-testsuite/web-fixtures/issue140.php:    echo $_COOKIE[\"tc\"];\r\n./driver-testsuite/web-fixtures/print_cookies.php:    <?php echo str_replace('>', '', var_export($_COOKIE, true)); ?>\r\n```\r\n\r\nI didn't look into fixing any more of them.\r\n"},"comment":{"url":"https://api.github.com/repos/minkphp/Mink/issues/comments/194308135","html_url":"https://github.com/minkphp/Mink/pull/677#issuecomment-194308135","issue_url":"https://api.github.com/repos/minkphp/Mink/issues/677","id":194308135,"user":{"login":"aik099","id":1277526,"avatar_url":"https://avatars.githubusercontent.com/u/1277526?v=3","gravatar_id":"","url":"https://api.github.com/users/aik099","html_url":"https://github.com/aik099","followers_url":"https://api.github.com/users/aik099/followers","following_url":"https://api.github.com/users/aik099/following{/other_user}","gists_url":"https://api.github.com/users/aik099/gists{/gist_id}","starred_url":"https://api.github.com/users/aik099/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aik099/subscriptions","organizations_url":"https://api.github.com/users/aik099/orgs","repos_url":"https://api.github.com/users/aik099/repos","events_url":"https://api.github.com/users/aik099/events{/privacy}","received_events_url":"https://api.github.com/users/aik099/received_events","type":"User","site_admin":false},"created_at":"2016-03-09T14:00:44Z","updated_at":"2016-03-09T14:00:44Z","body":"You're welcome. At least now people having `vendor` folder inside DocumentRoot won't have any XSS-related problems."}}