{"action":"closed","number":1224,"pull_request":{"url":"https://api.github.com/repos/markedjs/marked/pulls/1224","id":181738622,"html_url":"https://github.com/markedjs/marked/pull/1224","diff_url":"https://github.com/markedjs/marked/pull/1224.diff","patch_url":"https://github.com/markedjs/marked/pull/1224.patch","issue_url":"https://api.github.com/repos/markedjs/marked/issues/1224","number":1224,"state":"closed","locked":false,"title":"security: fix unsafe heading regex","user":{"login":"davisjam","id":22822319,"avatar_url":"https://avatars0.githubusercontent.com/u/22822319?v=4","gravatar_id":"","url":"https://api.github.com/users/davisjam","html_url":"https://github.com/davisjam","followers_url":"https://api.github.com/users/davisjam/followers","following_url":"https://api.github.com/users/davisjam/following{/other_user}","gists_url":"https://api.github.com/users/davisjam/gists{/gist_id}","starred_url":"https://api.github.com/users/davisjam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davisjam/subscriptions","organizations_url":"https://api.github.com/users/davisjam/orgs","repos_url":"https://api.github.com/users/davisjam/repos","events_url":"https://api.github.com/users/davisjam/events{/privacy}","received_events_url":"https://api.github.com/users/davisjam/received_events","type":"User","site_admin":false},"body":"Problem:\r\nREDOS could be triggered through exploitation of the 'heading' regex.\r\n\r\nSolution:\r\nRefactor regex. It matches the same language as before but\r\nis less vulnerable to REDOS.\r\nIt is now safe using the bounds suggested by those disclosing it.\r\nIt remains super-linear but a successful exploit requires\r\na much longer attack string.\r\n\r\nFixes:\r\nIssue disclosed privately.\r\n\r\nCredit:\r\nThis issue was pointed out by\r\nNick Starke (@nstarke) and Adam Cazzolla (@atcazzual) of Sonatype Security research.","created_at":"2018-04-16T02:20:41Z","updated_at":"2018-04-16T12:37:27Z","closed_at":"2018-04-16T12:37:27Z","merged_at":"2018-04-16T12:37:27Z","merge_commit_sha":"09afabf69c6d0c919c03443f47bdfe476566105d","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/markedjs/marked/pulls/1224/commits","review_comments_url":"https://api.github.com/repos/markedjs/marked/pulls/1224/comments","review_comment_url":"https://api.github.com/repos/markedjs/marked/pulls/comments{/number}","comments_url":"https://api.github.com/repos/markedjs/marked/issues/1224/comments","statuses_url":"https://api.github.com/repos/markedjs/marked/statuses/f052a2c04ecb371faa8c3e1cb2c72afe0eb13618","head":{"label":"davisjam:SonatypeReport","ref":"SonatypeReport","sha":"f052a2c04ecb371faa8c3e1cb2c72afe0eb13618","user":{"login":"davisjam","id":22822319,"avatar_url":"https://avatars0.githubusercontent.com/u/22822319?v=4","gravatar_id":"","url":"https://api.github.com/users/davisjam","html_url":"https://github.com/davisjam","followers_url":"https://api.github.com/users/davisjam/followers","following_url":"https://api.github.com/users/davisjam/following{/other_user}","gists_url":"https://api.github.com/users/davisjam/gists{/gist_id}","starred_url":"https://api.github.com/users/davisjam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davisjam/subscriptions","organizations_url":"https://api.github.com/users/davisjam/orgs","repos_url":"https://api.github.com/users/davisjam/repos","events_url":"https://api.github.com/users/davisjam/events{/privacy}","received_events_url":"https://api.github.com/users/davisjam/received_events","type":"User","site_admin":false},"repo":{"id":122992274,"name":"marked","full_name":"davisjam/marked","owner":{"login":"davisjam","id":22822319,"avatar_url":"https://avatars0.githubusercontent.com/u/22822319?v=4","gravatar_id":"","url":"https://api.github.com/users/davisjam","html_url":"https://github.com/davisjam","followers_url":"https://api.github.com/users/davisjam/followers","following_url":"https://api.github.com/users/davisjam/following{/other_user}","gists_url":"https://api.github.com/users/davisjam/gists{/gist_id}","starred_url":"https://api.github.com/users/davisjam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davisjam/subscriptions","organizations_url":"https://api.github.com/users/davisjam/orgs","repos_url":"https://api.github.com/users/davisjam/repos","events_url":"https://api.github.com/users/davisjam/events{/privacy}","received_events_url":"https://api.github.com/users/davisjam/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/davisjam/marked","description":"A markdown parser and compiler. Built for speed.","fork":true,"url":"https://api.github.com/repos/davisjam/marked","forks_url":"https://api.github.com/repos/davisjam/marked/forks","keys_url":"https://api.github.com/repos/davisjam/marked/keys{/key_id}","collaborators_url":"https://api.github.com/repos/davisjam/marked/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/davisjam/marked/teams","hooks_url":"https://api.github.com/repos/davisjam/marked/hooks","issue_events_url":"https://api.github.com/repos/davisjam/marked/issues/events{/number}","events_url":"https://api.github.com/repos/davisjam/marked/events","assignees_url":"https://api.github.com/repos/davisjam/marked/assignees{/user}","branches_url":"https://api.github.com/repos/davisjam/marked/branches{/branch}","tags_url":"https://api.github.com/repos/davisjam/marked/tags","blobs_url":"https://api.github.com/repos/davisjam/marked/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/davisjam/marked/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/davisjam/marked/git/refs{/sha}","trees_url":"https://api.github.com/repos/davisjam/marked/git/trees{/sha}","statuses_url":"https://api.github.com/repos/davisjam/marked/statuses/{sha}","languages_url":"https://api.github.com/repos/davisjam/marked/languages","stargazers_url":"https://api.github.com/repos/davisjam/marked/stargazers","contributors_url":"https://api.github.com/repos/davisjam/marked/contributors","subscribers_url":"https://api.github.com/repos/davisjam/marked/subscribers","subscription_url":"https://api.github.com/repos/davisjam/marked/subscription","commits_url":"https://api.github.com/repos/davisjam/marked/commits{/sha}","git_commits_url":"https://api.github.com/repos/davisjam/marked/git/commits{/sha}","comments_url":"https://api.github.com/repos/davisjam/marked/comments{/number}","issue_comment_url":"https://api.github.com/repos/davisjam/marked/issues/comments{/number}","contents_url":"https://api.github.com/repos/davisjam/marked/contents/{+path}","compare_url":"https://api.github.com/repos/davisjam/marked/compare/{base}...{head}","merges_url":"https://api.github.com/repos/davisjam/marked/merges","archive_url":"https://api.github.com/repos/davisjam/marked/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/davisjam/marked/downloads","issues_url":"https://api.github.com/repos/davisjam/marked/issues{/number}","pulls_url":"https://api.github.com/repos/davisjam/marked/pulls{/number}","milestones_url":"https://api.github.com/repos/davisjam/marked/milestones{/number}","notifications_url":"https://api.github.com/repos/davisjam/marked/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/davisjam/marked/labels{/name}","releases_url":"https://api.github.com/repos/davisjam/marked/releases{/id}","deployments_url":"https://api.github.com/repos/davisjam/marked/deployments","created_at":"2018-02-26T15:51:12Z","updated_at":"2018-04-15T22:58:36Z","pushed_at":"2018-04-16T02:20:26Z","git_url":"git://github.com/davisjam/marked.git","ssh_url":"git@github.com:davisjam/marked.git","clone_url":"https://github.com/davisjam/marked.git","svn_url":"https://github.com/davisjam/marked","homepage":"","size":1198,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":null,"url":null},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"markedjs:master","ref":"master","sha":"3130e62bc210c68d8475e02a334f6a0fafa98d5f","user":{"login":"markedjs","id":19886934,"avatar_url":"https://avatars0.githubusercontent.com/u/19886934?v=4","gravatar_id":"","url":"https://api.github.com/users/markedjs","html_url":"https://github.com/markedjs","followers_url":"https://api.github.com/users/markedjs/followers","following_url":"https://api.github.com/users/markedjs/following{/other_user}","gists_url":"https://api.github.com/users/markedjs/gists{/gist_id}","starred_url":"https://api.github.com/users/markedjs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markedjs/subscriptions","organizations_url":"https://api.github.com/users/markedjs/orgs","repos_url":"https://api.github.com/users/markedjs/repos","events_url":"https://api.github.com/users/markedjs/events{/privacy}","received_events_url":"https://api.github.com/users/markedjs/received_events","type":"Organization","site_admin":false},"repo":{"id":2096579,"name":"marked","full_name":"markedjs/marked","owner":{"login":"markedjs","id":19886934,"avatar_url":"https://avatars0.githubusercontent.com/u/19886934?v=4","gravatar_id":"","url":"https://api.github.com/users/markedjs","html_url":"https://github.com/markedjs","followers_url":"https://api.github.com/users/markedjs/followers","following_url":"https://api.github.com/users/markedjs/following{/other_user}","gists_url":"https://api.github.com/users/markedjs/gists{/gist_id}","starred_url":"https://api.github.com/users/markedjs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markedjs/subscriptions","organizations_url":"https://api.github.com/users/markedjs/orgs","repos_url":"https://api.github.com/users/markedjs/repos","events_url":"https://api.github.com/users/markedjs/events{/privacy}","received_events_url":"https://api.github.com/users/markedjs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/markedjs/marked","description":"A markdown parser and compiler. Built for speed.","fork":false,"url":"https://api.github.com/repos/markedjs/marked","forks_url":"https://api.github.com/repos/markedjs/marked/forks","keys_url":"https://api.github.com/repos/markedjs/marked/keys{/key_id}","collaborators_url":"https://api.github.com/repos/markedjs/marked/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/markedjs/marked/teams","hooks_url":"https://api.github.com/repos/markedjs/marked/hooks","issue_events_url":"https://api.github.com/repos/markedjs/marked/issues/events{/number}","events_url":"https://api.github.com/repos/markedjs/marked/events","assignees_url":"https://api.github.com/repos/markedjs/marked/assignees{/user}","branches_url":"https://api.github.com/repos/markedjs/marked/branches{/branch}","tags_url":"https://api.github.com/repos/markedjs/marked/tags","blobs_url":"https://api.github.com/repos/markedjs/marked/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/markedjs/marked/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/markedjs/marked/git/refs{/sha}","trees_url":"https://api.github.com/repos/markedjs/marked/git/trees{/sha}","statuses_url":"https://api.github.com/repos/markedjs/marked/statuses/{sha}","languages_url":"https://api.github.com/repos/markedjs/marked/languages","stargazers_url":"https://api.github.com/repos/markedjs/marked/stargazers","contributors_url":"https://api.github.com/repos/markedjs/marked/contributors","subscribers_url":"https://api.github.com/repos/markedjs/marked/subscribers","subscription_url":"https://api.github.com/repos/markedjs/marked/subscription","commits_url":"https://api.github.com/repos/markedjs/marked/commits{/sha}","git_commits_url":"https://api.github.com/repos/markedjs/marked/git/commits{/sha}","comments_url":"https://api.github.com/repos/markedjs/marked/comments{/number}","issue_comment_url":"https://api.github.com/repos/markedjs/marked/issues/comments{/number}","contents_url":"https://api.github.com/repos/markedjs/marked/contents/{+path}","compare_url":"https://api.github.com/repos/markedjs/marked/compare/{base}...{head}","merges_url":"https://api.github.com/repos/markedjs/marked/merges","archive_url":"https://api.github.com/repos/markedjs/marked/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/markedjs/marked/downloads","issues_url":"https://api.github.com/repos/markedjs/marked/issues{/number}","pulls_url":"https://api.github.com/repos/markedjs/marked/pulls{/number}","milestones_url":"https://api.github.com/repos/markedjs/marked/milestones{/number}","notifications_url":"https://api.github.com/repos/markedjs/marked/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/markedjs/marked/labels{/name}","releases_url":"https://api.github.com/repos/markedjs/marked/releases{/id}","deployments_url":"https://api.github.com/repos/markedjs/marked/deployments","created_at":"2011-07-24T13:15:51Z","updated_at":"2018-04-16T11:28:22Z","pushed_at":"2018-04-16T12:37:28Z","git_url":"git://github.com/markedjs/marked.git","ssh_url":"git@github.com:markedjs/marked.git","clone_url":"https://github.com/markedjs/marked.git","svn_url":"https://github.com/markedjs/marked","homepage":"https://marked.js.org/","size":1187,"stargazers_count":15977,"watchers_count":15977,"language":"JavaScript","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":2195,"mirror_url":null,"archived":false,"open_issues_count":86,"license":{"key":"other","name":"Other","spdx_id":null,"url":null},"forks":2195,"open_issues":86,"watchers":15977,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/markedjs/marked/pulls/1224"},"html":{"href":"https://github.com/markedjs/marked/pull/1224"},"issue":{"href":"https://api.github.com/repos/markedjs/marked/issues/1224"},"comments":{"href":"https://api.github.com/repos/markedjs/marked/issues/1224/comments"},"review_comments":{"href":"https://api.github.com/repos/markedjs/marked/pulls/1224/comments"},"review_comment":{"href":"https://api.github.com/repos/markedjs/marked/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/markedjs/marked/pulls/1224/commits"},"statuses":{"href":"https://api.github.com/repos/markedjs/marked/statuses/f052a2c04ecb371faa8c3e1cb2c72afe0eb13618"}},"author_association":"COLLABORATOR","merged":true,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":{"login":"styfle","id":229881,"avatar_url":"https://avatars1.githubusercontent.com/u/229881?v=4","gravatar_id":"","url":"https://api.github.com/users/styfle","html_url":"https://github.com/styfle","followers_url":"https://api.github.com/users/styfle/followers","following_url":"https://api.github.com/users/styfle/following{/other_user}","gists_url":"https://api.github.com/users/styfle/gists{/gist_id}","starred_url":"https://api.github.com/users/styfle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/styfle/subscriptions","organizations_url":"https://api.github.com/users/styfle/orgs","repos_url":"https://api.github.com/users/styfle/repos","events_url":"https://api.github.com/users/styfle/events{/privacy}","received_events_url":"https://api.github.com/users/styfle/received_events","type":"User","site_admin":false},"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":1,"additions":1,"deletions":1,"changed_files":1}}
{"actor":{"display_login":"styfle"}}