{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Mvc/issues/4033","repository_url":"https://api.github.com/repos/aspnet/Mvc","labels_url":"https://api.github.com/repos/aspnet/Mvc/issues/4033/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Mvc/issues/4033/comments","events_url":"https://api.github.com/repos/aspnet/Mvc/issues/4033/events","html_url":"https://github.com/aspnet/Mvc/issues/4033","id":130769169,"number":4033,"title":"Remove Html.JavaScriptEncoder property","user":{"login":"blowdart","id":796298,"avatar_url":"https://avatars.githubusercontent.com/u/796298?v=3","gravatar_id":"","url":"https://api.github.com/users/blowdart","html_url":"https://github.com/blowdart","followers_url":"https://api.github.com/users/blowdart/followers","following_url":"https://api.github.com/users/blowdart/following{/other_user}","gists_url":"https://api.github.com/users/blowdart/gists{/gist_id}","starred_url":"https://api.github.com/users/blowdart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowdart/subscriptions","organizations_url":"https://api.github.com/users/blowdart/orgs","repos_url":"https://api.github.com/users/blowdart/repos","events_url":"https://api.github.com/users/blowdart/events{/privacy}","received_events_url":"https://api.github.com/users/blowdart/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet/Mvc/labels/3%20-%20Done","name":"3 - Done","color":"CCCCCC"},{"url":"https://api.github.com/repos/aspnet/Mvc/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"kichalla","id":6559784,"avatar_url":"https://avatars.githubusercontent.com/u/6559784?v=3","gravatar_id":"","url":"https://api.github.com/users/kichalla","html_url":"https://github.com/kichalla","followers_url":"https://api.github.com/users/kichalla/followers","following_url":"https://api.github.com/users/kichalla/following{/other_user}","gists_url":"https://api.github.com/users/kichalla/gists{/gist_id}","starred_url":"https://api.github.com/users/kichalla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kichalla/subscriptions","organizations_url":"https://api.github.com/users/kichalla/orgs","repos_url":"https://api.github.com/users/kichalla/repos","events_url":"https://api.github.com/users/kichalla/events{/privacy}","received_events_url":"https://api.github.com/users/kichalla/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/aspnet/Mvc/milestones/20","html_url":"https://github.com/aspnet/Mvc/milestones/1.0.0-rc2","labels_url":"https://api.github.com/repos/aspnet/Mvc/milestones/20/labels","id":1370810,"number":20,"title":"1.0.0-rc2","description":"","creator":{"login":"Eilon","id":202643,"avatar_url":"https://avatars.githubusercontent.com/u/202643?v=3","gravatar_id":"","url":"https://api.github.com/users/Eilon","html_url":"https://github.com/Eilon","followers_url":"https://api.github.com/users/Eilon/followers","following_url":"https://api.github.com/users/Eilon/following{/other_user}","gists_url":"https://api.github.com/users/Eilon/gists{/gist_id}","starred_url":"https://api.github.com/users/Eilon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Eilon/subscriptions","organizations_url":"https://api.github.com/users/Eilon/orgs","repos_url":"https://api.github.com/users/Eilon/repos","events_url":"https://api.github.com/users/Eilon/events{/privacy}","received_events_url":"https://api.github.com/users/Eilon/received_events","type":"User","site_admin":false},"open_issues":31,"closed_issues":136,"state":"open","created_at":"2015-10-22T16:51:50Z","updated_at":"2016-02-03T17:12:29Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2016-02-02T18:18:08Z","updated_at":"2016-02-03T17:12:29Z","closed_at":"2016-02-03T17:12:29Z","body":"This @ method is unsafe. It needs to be **removed**.\r\n\r\nWe've been recommending the safe approach for a couple of years, which is you put the data inside a DIV tag, in a data attribute, at which point @ and HTML encoding works just fine. \r\n\r\nThere are cases where simply Javascript encoding introduces XSS (for example, outputting into an OnX attribute on an element). The existence of this method encourages folks to do the wrong thing."},"comment":{"url":"https://api.github.com/repos/aspnet/Mvc/issues/comments/179353022","html_url":"https://github.com/aspnet/Mvc/issues/4033#issuecomment-179353022","issue_url":"https://api.github.com/repos/aspnet/Mvc/issues/4033","id":179353022,"user":{"login":"kichalla","id":6559784,"avatar_url":"https://avatars.githubusercontent.com/u/6559784?v=3","gravatar_id":"","url":"https://api.github.com/users/kichalla","html_url":"https://github.com/kichalla","followers_url":"https://api.github.com/users/kichalla/followers","following_url":"https://api.github.com/users/kichalla/following{/other_user}","gists_url":"https://api.github.com/users/kichalla/gists{/gist_id}","starred_url":"https://api.github.com/users/kichalla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kichalla/subscriptions","organizations_url":"https://api.github.com/users/kichalla/orgs","repos_url":"https://api.github.com/users/kichalla/repos","events_url":"https://api.github.com/users/kichalla/events{/privacy}","received_events_url":"https://api.github.com/users/kichalla/received_events","type":"User","site_admin":false},"created_at":"2016-02-03T17:12:29Z","updated_at":"2016-02-03T17:12:29Z","body":"bf93c7d7a440e514be8dd91558c15e1f3def4d7c"}}