{"action":"created","comment":{"url":"https://api.github.com/repos/angular/angular.js/pulls/comments/86028435","pull_request_review_id":6707497,"id":86028435,"diff_hunk":"@@ -1602,6 +1622,11 @@ function angularInit(element, bootstrap) {\n     }\n   });\n   if (appElement) {\n+    if (!isAutoBootstrapAllowed) {","path":"src/Angular.js","position":41,"original_position":31,"commit_id":"ca884808394fbe4a590297c47d87baee5cb8615d","original_commit_id":"b5e6da4d543eeed7b8c66d3ca741dbb68ac4f2fa","user":{"login":"gkalpak","id":8604205,"avatar_url":"https://avatars.githubusercontent.com/u/8604205?v=3","gravatar_id":"","url":"https://api.github.com/users/gkalpak","html_url":"https://github.com/gkalpak","followers_url":"https://api.github.com/users/gkalpak/followers","following_url":"https://api.github.com/users/gkalpak/following{/other_user}","gists_url":"https://api.github.com/users/gkalpak/gists{/gist_id}","starred_url":"https://api.github.com/users/gkalpak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gkalpak/subscriptions","organizations_url":"https://api.github.com/users/gkalpak/orgs","repos_url":"https://api.github.com/users/gkalpak/repos","events_url":"https://api.github.com/users/gkalpak/events{/privacy}","received_events_url":"https://api.github.com/users/gkalpak/received_events","type":"User","site_admin":false},"body":"Yeah, I thought it might be intentional. I don't expect anyone to be loading angular over `resource:` on non-extension pages, but you never know :smiley:\r\n\r\nHm...so, if it is a supported usecase (loading angular.js over `resource:` on non-extension pages), isn't this chage breaking? In that case, we should have a breaking change notice.","created_at":"2016-11-01T21:23:11Z","updated_at":"2016-11-01T21:23:37Z","html_url":"https://github.com/angular/angular.js/pull/15346#discussion_r86028435","pull_request_url":"https://api.github.com/repos/angular/angular.js/pulls/15346","_links":{"self":{"href":"https://api.github.com/repos/angular/angular.js/pulls/comments/86028435"},"html":{"href":"https://github.com/angular/angular.js/pull/15346#discussion_r86028435"},"pull_request":{"href":"https://api.github.com/repos/angular/angular.js/pulls/15346"}}},"pull_request":{"url":"https://api.github.com/repos/angular/angular.js/pulls/15346","id":91835158,"html_url":"https://github.com/angular/angular.js/pull/15346","diff_url":"https://github.com/angular/angular.js/pull/15346.diff","patch_url":"https://github.com/angular/angular.js/pull/15346.patch","issue_url":"https://api.github.com/repos/angular/angular.js/issues/15346","number":15346,"state":"open","locked":false,"title":"fix(security): do not auto-bootstrap when loaded from an extension.","user":{"login":"mprobst","id":7208,"avatar_url":"https://avatars.githubusercontent.com/u/7208?v=3","gravatar_id":"","url":"https://api.github.com/users/mprobst","html_url":"https://github.com/mprobst","followers_url":"https://api.github.com/users/mprobst/followers","following_url":"https://api.github.com/users/mprobst/following{/other_user}","gists_url":"https://api.github.com/users/mprobst/gists{/gist_id}","starred_url":"https://api.github.com/users/mprobst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mprobst/subscriptions","organizations_url":"https://api.github.com/users/mprobst/orgs","repos_url":"https://api.github.com/users/mprobst/repos","events_url":"https://api.github.com/users/mprobst/events{/privacy}","received_events_url":"https://api.github.com/users/mprobst/received_events","type":"User","site_admin":false},"body":"Extension URIs (`resource://...`) bypass Content-Security-Policy in Chrome and\r\nFirefox and can always be loaded. Now if a site already has a XSS bug, and uses\r\nCSP to protect itself, but the user has an extension installed that uses\r\nAngular, an attacked can load Angular from the extension, and Angular's\r\nauto-bootstrapping can be used to bypass the victim site's CSP protection.\r\n\r\nNotes:\r\n- `isAutoBootstrapAllowed` must be initialized on load, so that `currentScript`\r\n  is set correctly.\r\n- The tests are a bit indirect as reproducing the actual scenario is too\r\n  complicated to reproduce (requires signing an extension etc). I have confirmed\r\n  this to be working manually.","created_at":"2016-11-01T18:15:21Z","updated_at":"2016-11-01T21:23:37Z","closed_at":null,"merged_at":null,"merge_commit_sha":"2bc0ad7e83dd2af471faeec4e035d40574c526b9","assignee":{"login":"petebacondarwin","id":15655,"avatar_url":"https://avatars.githubusercontent.com/u/15655?v=3","gravatar_id":"","url":"https://api.github.com/users/petebacondarwin","html_url":"https://github.com/petebacondarwin","followers_url":"https://api.github.com/users/petebacondarwin/followers","following_url":"https://api.github.com/users/petebacondarwin/following{/other_user}","gists_url":"https://api.github.com/users/petebacondarwin/gists{/gist_id}","starred_url":"https://api.github.com/users/petebacondarwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petebacondarwin/subscriptions","organizations_url":"https://api.github.com/users/petebacondarwin/orgs","repos_url":"https://api.github.com/users/petebacondarwin/repos","events_url":"https://api.github.com/users/petebacondarwin/events{/privacy}","received_events_url":"https://api.github.com/users/petebacondarwin/received_events","type":"User","site_admin":false},"assignees":[{"login":"petebacondarwin","id":15655,"avatar_url":"https://avatars.githubusercontent.com/u/15655?v=3","gravatar_id":"","url":"https://api.github.com/users/petebacondarwin","html_url":"https://github.com/petebacondarwin","followers_url":"https://api.github.com/users/petebacondarwin/followers","following_url":"https://api.github.com/users/petebacondarwin/following{/other_user}","gists_url":"https://api.github.com/users/petebacondarwin/gists{/gist_id}","starred_url":"https://api.github.com/users/petebacondarwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petebacondarwin/subscriptions","organizations_url":"https://api.github.com/users/petebacondarwin/orgs","repos_url":"https://api.github.com/users/petebacondarwin/repos","events_url":"https://api.github.com/users/petebacondarwin/events{/privacy}","received_events_url":"https://api.github.com/users/petebacondarwin/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/angular/angular.js/milestones/126","html_url":"https://github.com/angular/angular.js/milestones/1.5.9","labels_url":"https://api.github.com/repos/angular/angular.js/milestones/126/labels","id":1899091,"number":126,"title":"1.5.9","description":"","creator":{"login":"petebacondarwin","id":15655,"avatar_url":"https://avatars.githubusercontent.com/u/15655?v=3","gravatar_id":"","url":"https://api.github.com/users/petebacondarwin","html_url":"https://github.com/petebacondarwin","followers_url":"https://api.github.com/users/petebacondarwin/followers","following_url":"https://api.github.com/users/petebacondarwin/following{/other_user}","gists_url":"https://api.github.com/users/petebacondarwin/gists{/gist_id}","starred_url":"https://api.github.com/users/petebacondarwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petebacondarwin/subscriptions","organizations_url":"https://api.github.com/users/petebacondarwin/orgs","repos_url":"https://api.github.com/users/petebacondarwin/repos","events_url":"https://api.github.com/users/petebacondarwin/events{/privacy}","received_events_url":"https://api.github.com/users/petebacondarwin/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":20,"state":"open","created_at":"2016-07-22T15:05:36Z","updated_at":"2016-11-01T20:25:38Z","due_on":"2016-07-25T23:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/angular/angular.js/pulls/15346/commits","review_comments_url":"https://api.github.com/repos/angular/angular.js/pulls/15346/comments","review_comment_url":"https://api.github.com/repos/angular/angular.js/pulls/comments{/number}","comments_url":"https://api.github.com/repos/angular/angular.js/issues/15346/comments","statuses_url":"https://api.github.com/repos/angular/angular.js/statuses/ca884808394fbe4a590297c47d87baee5cb8615d","head":{"label":"mprobst:protocols-resources-bootstrap","ref":"protocols-resources-bootstrap","sha":"ca884808394fbe4a590297c47d87baee5cb8615d","user":{"login":"mprobst","id":7208,"avatar_url":"https://avatars.githubusercontent.com/u/7208?v=3","gravatar_id":"","url":"https://api.github.com/users/mprobst","html_url":"https://github.com/mprobst","followers_url":"https://api.github.com/users/mprobst/followers","following_url":"https://api.github.com/users/mprobst/following{/other_user}","gists_url":"https://api.github.com/users/mprobst/gists{/gist_id}","starred_url":"https://api.github.com/users/mprobst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mprobst/subscriptions","organizations_url":"https://api.github.com/users/mprobst/orgs","repos_url":"https://api.github.com/users/mprobst/repos","events_url":"https://api.github.com/users/mprobst/events{/privacy}","received_events_url":"https://api.github.com/users/mprobst/received_events","type":"User","site_admin":false},"repo":{"id":7506880,"name":"angular.js","full_name":"mprobst/angular.js","owner":{"login":"mprobst","id":7208,"avatar_url":"https://avatars.githubusercontent.com/u/7208?v=3","gravatar_id":"","url":"https://api.github.com/users/mprobst","html_url":"https://github.com/mprobst","followers_url":"https://api.github.com/users/mprobst/followers","following_url":"https://api.github.com/users/mprobst/following{/other_user}","gists_url":"https://api.github.com/users/mprobst/gists{/gist_id}","starred_url":"https://api.github.com/users/mprobst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mprobst/subscriptions","organizations_url":"https://api.github.com/users/mprobst/orgs","repos_url":"https://api.github.com/users/mprobst/repos","events_url":"https://api.github.com/users/mprobst/events{/privacy}","received_events_url":"https://api.github.com/users/mprobst/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mprobst/angular.js","description":null,"fork":true,"url":"https://api.github.com/repos/mprobst/angular.js","forks_url":"https://api.github.com/repos/mprobst/angular.js/forks","keys_url":"https://api.github.com/repos/mprobst/angular.js/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mprobst/angular.js/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mprobst/angular.js/teams","hooks_url":"https://api.github.com/repos/mprobst/angular.js/hooks","issue_events_url":"https://api.github.com/repos/mprobst/angular.js/issues/events{/number}","events_url":"https://api.github.com/repos/mprobst/angular.js/events","assignees_url":"https://api.github.com/repos/mprobst/angular.js/assignees{/user}","branches_url":"https://api.github.com/repos/mprobst/angular.js/branches{/branch}","tags_url":"https://api.github.com/repos/mprobst/angular.js/tags","blobs_url":"https://api.github.com/repos/mprobst/angular.js/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mprobst/angular.js/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mprobst/angular.js/git/refs{/sha}","trees_url":"https://api.github.com/repos/mprobst/angular.js/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mprobst/angular.js/statuses/{sha}","languages_url":"https://api.github.com/repos/mprobst/angular.js/languages","stargazers_url":"https://api.github.com/repos/mprobst/angular.js/stargazers","contributors_url":"https://api.github.com/repos/mprobst/angular.js/contributors","subscribers_url":"https://api.github.com/repos/mprobst/angular.js/subscribers","subscription_url":"https://api.github.com/repos/mprobst/angular.js/subscription","commits_url":"https://api.github.com/repos/mprobst/angular.js/commits{/sha}","git_commits_url":"https://api.github.com/repos/mprobst/angular.js/git/commits{/sha}","comments_url":"https://api.github.com/repos/mprobst/angular.js/comments{/number}","issue_comment_url":"https://api.github.com/repos/mprobst/angular.js/issues/comments{/number}","contents_url":"https://api.github.com/repos/mprobst/angular.js/contents/{+path}","compare_url":"https://api.github.com/repos/mprobst/angular.js/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mprobst/angular.js/merges","archive_url":"https://api.github.com/repos/mprobst/angular.js/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mprobst/angular.js/downloads","issues_url":"https://api.github.com/repos/mprobst/angular.js/issues{/number}","pulls_url":"https://api.github.com/repos/mprobst/angular.js/pulls{/number}","milestones_url":"https://api.github.com/repos/mprobst/angular.js/milestones{/number}","notifications_url":"https://api.github.com/repos/mprobst/angular.js/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mprobst/angular.js/labels{/name}","releases_url":"https://api.github.com/repos/mprobst/angular.js/releases{/id}","deployments_url":"https://api.github.com/repos/mprobst/angular.js/deployments","created_at":"2013-01-08T18:36:29Z","updated_at":"2015-08-17T11:29:56Z","pushed_at":"2016-11-01T20:48:30Z","git_url":"git://github.com/mprobst/angular.js.git","ssh_url":"git@github.com:mprobst/angular.js.git","clone_url":"https://github.com/mprobst/angular.js.git","svn_url":"https://github.com/mprobst/angular.js","homepage":"http://angularjs.org","size":75770,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"angular:master","ref":"master","sha":"3b7f29ff63e8bf02327a1430dcc2a4c83915a206","user":{"login":"angular","id":139426,"avatar_url":"https://avatars.githubusercontent.com/u/139426?v=3","gravatar_id":"","url":"https://api.github.com/users/angular","html_url":"https://github.com/angular","followers_url":"https://api.github.com/users/angular/followers","following_url":"https://api.github.com/users/angular/following{/other_user}","gists_url":"https://api.github.com/users/angular/gists{/gist_id}","starred_url":"https://api.github.com/users/angular/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/angular/subscriptions","organizations_url":"https://api.github.com/users/angular/orgs","repos_url":"https://api.github.com/users/angular/repos","events_url":"https://api.github.com/users/angular/events{/privacy}","received_events_url":"https://api.github.com/users/angular/received_events","type":"Organization","site_admin":false},"repo":{"id":460078,"name":"angular.js","full_name":"angular/angular.js","owner":{"login":"angular","id":139426,"avatar_url":"https://avatars.githubusercontent.com/u/139426?v=3","gravatar_id":"","url":"https://api.github.com/users/angular","html_url":"https://github.com/angular","followers_url":"https://api.github.com/users/angular/followers","following_url":"https://api.github.com/users/angular/following{/other_user}","gists_url":"https://api.github.com/users/angular/gists{/gist_id}","starred_url":"https://api.github.com/users/angular/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/angular/subscriptions","organizations_url":"https://api.github.com/users/angular/orgs","repos_url":"https://api.github.com/users/angular/repos","events_url":"https://api.github.com/users/angular/events{/privacy}","received_events_url":"https://api.github.com/users/angular/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/angular/angular.js","description":"HTML enhanced for web apps","fork":false,"url":"https://api.github.com/repos/angular/angular.js","forks_url":"https://api.github.com/repos/angular/angular.js/forks","keys_url":"https://api.github.com/repos/angular/angular.js/keys{/key_id}","collaborators_url":"https://api.github.com/repos/angular/angular.js/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/angular/angular.js/teams","hooks_url":"https://api.github.com/repos/angular/angular.js/hooks","issue_events_url":"https://api.github.com/repos/angular/angular.js/issues/events{/number}","events_url":"https://api.github.com/repos/angular/angular.js/events","assignees_url":"https://api.github.com/repos/angular/angular.js/assignees{/user}","branches_url":"https://api.github.com/repos/angular/angular.js/branches{/branch}","tags_url":"https://api.github.com/repos/angular/angular.js/tags","blobs_url":"https://api.github.com/repos/angular/angular.js/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/angular/angular.js/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/angular/angular.js/git/refs{/sha}","trees_url":"https://api.github.com/repos/angular/angular.js/git/trees{/sha}","statuses_url":"https://api.github.com/repos/angular/angular.js/statuses/{sha}","languages_url":"https://api.github.com/repos/angular/angular.js/languages","stargazers_url":"https://api.github.com/repos/angular/angular.js/stargazers","contributors_url":"https://api.github.com/repos/angular/angular.js/contributors","subscribers_url":"https://api.github.com/repos/angular/angular.js/subscribers","subscription_url":"https://api.github.com/repos/angular/angular.js/subscription","commits_url":"https://api.github.com/repos/angular/angular.js/commits{/sha}","git_commits_url":"https://api.github.com/repos/angular/angular.js/git/commits{/sha}","comments_url":"https://api.github.com/repos/angular/angular.js/comments{/number}","issue_comment_url":"https://api.github.com/repos/angular/angular.js/issues/comments{/number}","contents_url":"https://api.github.com/repos/angular/angular.js/contents/{+path}","compare_url":"https://api.github.com/repos/angular/angular.js/compare/{base}...{head}","merges_url":"https://api.github.com/repos/angular/angular.js/merges","archive_url":"https://api.github.com/repos/angular/angular.js/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/angular/angular.js/downloads","issues_url":"https://api.github.com/repos/angular/angular.js/issues{/number}","pulls_url":"https://api.github.com/repos/angular/angular.js/pulls{/number}","milestones_url":"https://api.github.com/repos/angular/angular.js/milestones{/number}","notifications_url":"https://api.github.com/repos/angular/angular.js/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/angular/angular.js/labels{/name}","releases_url":"https://api.github.com/repos/angular/angular.js/releases{/id}","deployments_url":"https://api.github.com/repos/angular/angular.js/deployments","created_at":"2010-01-06T00:34:37Z","updated_at":"2016-11-01T21:09:18Z","pushed_at":"2016-11-01T20:49:09Z","git_url":"git://github.com/angular/angular.js.git","ssh_url":"git@github.com:angular/angular.js.git","clone_url":"https://github.com/angular/angular.js.git","svn_url":"https://github.com/angular/angular.js","homepage":"http://angularjs.org","size":185705,"stargazers_count":53055,"watchers_count":53055,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":26205,"mirror_url":null,"open_issues_count":859,"forks":26205,"open_issues":859,"watchers":53055,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/angular/angular.js/pulls/15346"},"html":{"href":"https://github.com/angular/angular.js/pull/15346"},"issue":{"href":"https://api.github.com/repos/angular/angular.js/issues/15346"},"comments":{"href":"https://api.github.com/repos/angular/angular.js/issues/15346/comments"},"review_comments":{"href":"https://api.github.com/repos/angular/angular.js/pulls/15346/comments"},"review_comment":{"href":"https://api.github.com/repos/angular/angular.js/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/angular/angular.js/pulls/15346/commits"},"statuses":{"href":"https://api.github.com/repos/angular/angular.js/statuses/ca884808394fbe4a590297c47d87baee5cb8615d"}}}}
{"actor":{"display_login":"gkalpak"}}