{"action":"created","issue":{"url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/4357","labels_url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/4357/labels{/name}","comments_url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/4357/comments","events_url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/4357/events","html_url":"https://github.com/bcit-ci/CodeIgniter/issues/4357","id":124748766,"number":4357,"title":"Email with name incorrectly filtered by XSS Clean","user":{"login":"pijulius","id":567420,"avatar_url":"https://avatars.githubusercontent.com/u/567420?v=3","gravatar_id":"","url":"https://api.github.com/users/pijulius","html_url":"https://github.com/pijulius","followers_url":"https://api.github.com/users/pijulius/followers","following_url":"https://api.github.com/users/pijulius/following{/other_user}","gists_url":"https://api.github.com/users/pijulius/gists{/gist_id}","starred_url":"https://api.github.com/users/pijulius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pijulius/subscriptions","organizations_url":"https://api.github.com/users/pijulius/orgs","repos_url":"https://api.github.com/users/pijulius/repos","events_url":"https://api.github.com/users/pijulius/events{/privacy}","received_events_url":"https://api.github.com/users/pijulius/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/bcit-ci/CodeIgniter/labels/Won't%20Fix","name":"Won't Fix","color":"f7c6c7"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-01-04T12:12:45Z","updated_at":"2016-01-04T13:22:21Z","closed_at":"2016-01-04T12:22:23Z","body":"Hi Guys,\r\n\r\nIt seems the latest changes in the Security.php broke the email validation and so this way the emails with names became invalid emails.\r\n\r\nFor e.g.:\r\nYour Name &lt;your@email.com>\r\n\r\nwill become:\r\nYour Name &lt;your>\r\n\r\nafter a submit.\r\n\r\nI tested this on both latest CI 3.0.3 and old CI2 and both have this issue and of course this wasn't the case before the last update on both CI2 and CI3 either.\r\n\r\nI also know we can disable xss to make it work but that would be the wrong solution in my opinion, not to mention this shouldn't be filtered by xss anyway as it's not an invalid tag nor does it have any harmful content so it should be working as it was just before the latest releases.\r\n\r\nLet me know if you need any more information on it, I see it has to to with xss_clean() function at \"Sanitize naughty HTML elements\" part where it wrongly parses the email and sets \"email.com\" as attribute and \"your\" as the tagname.\r\n\r\nRegards,\r\nJ\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/comments/168675332","html_url":"https://github.com/bcit-ci/CodeIgniter/issues/4357#issuecomment-168675332","issue_url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/4357","id":168675332,"user":{"login":"pijulius","id":567420,"avatar_url":"https://avatars.githubusercontent.com/u/567420?v=3","gravatar_id":"","url":"https://api.github.com/users/pijulius","html_url":"https://github.com/pijulius","followers_url":"https://api.github.com/users/pijulius/followers","following_url":"https://api.github.com/users/pijulius/following{/other_user}","gists_url":"https://api.github.com/users/pijulius/gists{/gist_id}","starred_url":"https://api.github.com/users/pijulius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pijulius/subscriptions","organizations_url":"https://api.github.com/users/pijulius/orgs","repos_url":"https://api.github.com/users/pijulius/repos","events_url":"https://api.github.com/users/pijulius/events{/privacy}","received_events_url":"https://api.github.com/users/pijulius/received_events","type":"User","site_admin":false},"created_at":"2016-01-04T13:22:21Z","updated_at":"2016-01-04T13:22:21Z","body":"Hi There,\r\n\r\nYou misunderstood my whole note :)\r\n\r\nI don't use that to display it on a website, I use it to store the \"Name &lt;email@domain.com>\" value in the db and then use it to send emails from this address so it has nothing to do with displaying it anywhere on the website so indeed this is a false positive and could be easily fixed (as it was working just fine before the last release) and it has nothing to do with html nor with github or anyone else :)\r\n\r\nRegards,\r\nJ"}}