{"action":"created","issue":{"url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/4638","repository_url":"https://api.github.com/repos/HabitRPG/habitrpg","labels_url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/4638/labels{/name}","comments_url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/4638/comments","events_url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/4638/events","html_url":"https://github.com/HabitRPG/habitrpg/issues/4638","id":56706410,"number":4638,"title":"XSS / Cross-site scripting issue in markdown","user":{"login":"Kerstman","id":8595054,"avatar_url":"https://avatars.githubusercontent.com/u/8595054?v=3","gravatar_id":"","url":"https://api.github.com/users/Kerstman","html_url":"https://github.com/Kerstman","followers_url":"https://api.github.com/users/Kerstman/followers","following_url":"https://api.github.com/users/Kerstman/following{/other_user}","gists_url":"https://api.github.com/users/Kerstman/gists{/gist_id}","starred_url":"https://api.github.com/users/Kerstman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kerstman/subscriptions","organizations_url":"https://api.github.com/users/Kerstman/orgs","repos_url":"https://api.github.com/users/Kerstman/repos","events_url":"https://api.github.com/users/Kerstman/events{/privacy}","received_events_url":"https://api.github.com/users/Kerstman/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-05T18:05:29Z","updated_at":"2016-04-28T13:51:21Z","closed_at":"2016-04-28T13:51:21Z","body":"The input for the markdown is not sanitized properly, a link with a javascript-handler can be added with the following markdown code:\r\n\r\n`[linkname](javascript:alert%28%22XSS%22%29%3B)`\r\n\r\nThis can be exploited in for example direct messages or the chat functionality.\r\n\r\nSuggested fix: only allow links starting with \"http://\" or \"https://\" and disallow \"javascript:\" links.\r\n\r\n\r\n<bountysource-plugin>\r\n---\r\nWant to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/8321277-xss-cross-site-scripting-issue-in-markdown?utm_campaign=plugin&utm_content=tracker%2F68393&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F68393&utm_medium=issues&utm_source=github).\r\n</bountysource-plugin>"},"comment":{"url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/comments/215429895","html_url":"https://github.com/HabitRPG/habitrpg/issues/4638#issuecomment-215429895","issue_url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/4638","id":215429895,"user":{"login":"crookedneighbor","id":2916945,"avatar_url":"https://avatars.githubusercontent.com/u/2916945?v=3","gravatar_id":"","url":"https://api.github.com/users/crookedneighbor","html_url":"https://github.com/crookedneighbor","followers_url":"https://api.github.com/users/crookedneighbor/followers","following_url":"https://api.github.com/users/crookedneighbor/following{/other_user}","gists_url":"https://api.github.com/users/crookedneighbor/gists{/gist_id}","starred_url":"https://api.github.com/users/crookedneighbor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crookedneighbor/subscriptions","organizations_url":"https://api.github.com/users/crookedneighbor/orgs","repos_url":"https://api.github.com/users/crookedneighbor/repos","events_url":"https://api.github.com/users/crookedneighbor/events{/privacy}","received_events_url":"https://api.github.com/users/crookedneighbor/received_events","type":"User","site_admin":false},"created_at":"2016-04-28T13:51:21Z","updated_at":"2016-04-28T13:51:21Z","body":"Oh gosh, I forgot this was ever opened. "}}