{"action":"created","issue":{"url":"https://api.github.com/repos/express-vue/express-vue/issues/182","repository_url":"https://api.github.com/repos/express-vue/express-vue","labels_url":"https://api.github.com/repos/express-vue/express-vue/issues/182/labels{/name}","comments_url":"https://api.github.com/repos/express-vue/express-vue/issues/182/comments","events_url":"https://api.github.com/repos/express-vue/express-vue/issues/182/events","html_url":"https://github.com/express-vue/express-vue/issues/182","id":324584253,"number":182,"title":"Data with </script> isn't being escaped. Leads to XSS vulnerabilities.","user":{"login":"choyg","id":15039867,"avatar_url":"https://avatars1.githubusercontent.com/u/15039867?v=4","gravatar_id":"","url":"https://api.github.com/users/choyg","html_url":"https://github.com/choyg","followers_url":"https://api.github.com/users/choyg/followers","following_url":"https://api.github.com/users/choyg/following{/other_user}","gists_url":"https://api.github.com/users/choyg/gists{/gist_id}","starred_url":"https://api.github.com/users/choyg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/choyg/subscriptions","organizations_url":"https://api.github.com/users/choyg/orgs","repos_url":"https://api.github.com/users/choyg/repos","events_url":"https://api.github.com/users/choyg/events{/privacy}","received_events_url":"https://api.github.com/users/choyg/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-05-19T00:10:55Z","updated_at":"2018-05-23T18:40:12Z","closed_at":"2018-05-23T06:53:40Z","author_association":"NONE","body":"<Please Fill out this template so that I can help you better>\r\n<Make Sure you have read the readme, and search existing issues before opening a new one>\r\n\r\n### Description of Issue\r\n\r\nPassing data which contains `</script>` allows for XSS. This can be reproduced in the sample [Express-Vue MVC Starter Kit](https://github.com/express-vue/express-vue-site) TodoMVC by typing `</script><script>alert('Hello World');</script>` or from the [share url](http://localhost:9000/todo?share=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1MjY2OTExMTIsImRhdGEiOlt7ImlkIjowLCJ0aXRsZSI6IkVhdCBGb29kIiwiY29tcGxldGVkIjpmYWxzZX0seyJpZCI6MSwidGl0bGUiOiJTbGVlcCIsImNvbXBsZXRlZCI6ZmFsc2V9LHsiaWQiOjIsInRpdGxlIjoiRHJpbmsgQ29mZmVlIiwiY29tcGxldGVkIjpmYWxzZX0seyJpZCI6MywidGl0bGUiOiJXcml0ZSBDb2RlIiwiY29tcGxldGVkIjpmYWxzZX0seyJpZCI6NSwidGl0bGUiOiJvayIsImNvbXBsZXRlZCI6ZmFsc2V9LHsiaWQiOjYsInRpdGxlIjoiPC9zY3JpcHQ-PHNjcmlwdD4gYWxlcnQoJ2hlbGxvIHdvcmxkJykgPC9zY3JpcHQ-IiwiY29tcGxldGVkIjpmYWxzZX1dLCJpYXQiOjE1MjY2ODc1MTJ9.2WhLGBniKfnMiKoPwolgDqz849gk-KivKTNvM9Dsel0).\r\n\r\nI couldn't find any similar note in docs/issues except possibly #67. \r\n\r\n### Stack Trace / Console Log\r\nUncaught SyntaxError: Invalid or unexpected token\r\n\r\n### Additional Comments"},"comment":{"url":"https://api.github.com/repos/express-vue/express-vue/issues/comments/391454457","html_url":"https://github.com/express-vue/express-vue/issues/182#issuecomment-391454457","issue_url":"https://api.github.com/repos/express-vue/express-vue/issues/182","id":391454457,"user":{"login":"choyg","id":15039867,"avatar_url":"https://avatars1.githubusercontent.com/u/15039867?v=4","gravatar_id":"","url":"https://api.github.com/users/choyg","html_url":"https://github.com/choyg","followers_url":"https://api.github.com/users/choyg/followers","following_url":"https://api.github.com/users/choyg/following{/other_user}","gists_url":"https://api.github.com/users/choyg/gists{/gist_id}","starred_url":"https://api.github.com/users/choyg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/choyg/subscriptions","organizations_url":"https://api.github.com/users/choyg/orgs","repos_url":"https://api.github.com/users/choyg/repos","events_url":"https://api.github.com/users/choyg/events{/privacy}","received_events_url":"https://api.github.com/users/choyg/received_events","type":"User","site_admin":false},"created_at":"2018-05-23T18:40:12Z","updated_at":"2018-05-23T18:40:12Z","author_association":"NONE","body":"Thanks for the quick update. I've made an additional PR in js-to-string if you want to take a look. Sorry for  multiple but I didn't notice some vectors in the original PR."}}
{"actor":{"display_login":"choyg"}}