{"action":"closed","issue":{"url":"https://api.github.com/repos/decred/politeiagui/issues/882","repository_url":"https://api.github.com/repos/decred/politeiagui","labels_url":"https://api.github.com/repos/decred/politeiagui/issues/882/labels{/name}","comments_url":"https://api.github.com/repos/decred/politeiagui/issues/882/comments","events_url":"https://api.github.com/repos/decred/politeiagui/issues/882/events","html_url":"https://github.com/decred/politeiagui/issues/882","id":379849388,"node_id":"MDU6SXNzdWUzNzk4NDkzODg=","number":882,"title":"Error page text injection","user":{"login":"lukebp","id":9039877,"node_id":"MDQ6VXNlcjkwMzk4Nzc=","avatar_url":"https://avatars3.githubusercontent.com/u/9039877?v=4","gravatar_id":"","url":"https://api.github.com/users/lukebp","html_url":"https://github.com/lukebp","followers_url":"https://api.github.com/users/lukebp/followers","following_url":"https://api.github.com/users/lukebp/following{/other_user}","gists_url":"https://api.github.com/users/lukebp/gists{/gist_id}","starred_url":"https://api.github.com/users/lukebp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lukebp/subscriptions","organizations_url":"https://api.github.com/users/lukebp/orgs","repos_url":"https://api.github.com/users/lukebp/repos","events_url":"https://api.github.com/users/lukebp/events{/privacy}","received_events_url":"https://api.github.com/users/lukebp/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"fernandoabolafio","id":14864439,"node_id":"MDQ6VXNlcjE0ODY0NDM5","avatar_url":"https://avatars1.githubusercontent.com/u/14864439?v=4","gravatar_id":"","url":"https://api.github.com/users/fernandoabolafio","html_url":"https://github.com/fernandoabolafio","followers_url":"https://api.github.com/users/fernandoabolafio/followers","following_url":"https://api.github.com/users/fernandoabolafio/following{/other_user}","gists_url":"https://api.github.com/users/fernandoabolafio/gists{/gist_id}","starred_url":"https://api.github.com/users/fernandoabolafio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fernandoabolafio/subscriptions","organizations_url":"https://api.github.com/users/fernandoabolafio/orgs","repos_url":"https://api.github.com/users/fernandoabolafio/repos","events_url":"https://api.github.com/users/fernandoabolafio/events{/privacy}","received_events_url":"https://api.github.com/users/fernandoabolafio/received_events","type":"User","site_admin":false},"assignees":[{"login":"fernandoabolafio","id":14864439,"node_id":"MDQ6VXNlcjE0ODY0NDM5","avatar_url":"https://avatars1.githubusercontent.com/u/14864439?v=4","gravatar_id":"","url":"https://api.github.com/users/fernandoabolafio","html_url":"https://github.com/fernandoabolafio","followers_url":"https://api.github.com/users/fernandoabolafio/followers","following_url":"https://api.github.com/users/fernandoabolafio/following{/other_user}","gists_url":"https://api.github.com/users/fernandoabolafio/gists{/gist_id}","starred_url":"https://api.github.com/users/fernandoabolafio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fernandoabolafio/subscriptions","organizations_url":"https://api.github.com/users/fernandoabolafio/orgs","repos_url":"https://api.github.com/users/fernandoabolafio/repos","events_url":"https://api.github.com/users/fernandoabolafio/events{/privacy}","received_events_url":"https://api.github.com/users/fernandoabolafio/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-11-12T16:16:34Z","updated_at":"2018-11-14T21:38:02Z","closed_at":"2018-11-14T21:38:02Z","author_association":"MEMBER","body":"decred/politeia#563\r\nI originally filed this issue in the politeia repo, but I think it's mainly a gui issue.  Let me know if any www changes are needed. \r\n\r\nVulnerability: Error page text injection at https://test-proposals.decred.org/\r\n\r\nDescription: attacker is able to inject text into error page and can trap user to visit other site\r\n\r\nUrl:\r\nhttps://test-proposals.decred.org/500?error=you%20are%20hacked%2f/%27website%20has%20been%20changed%20to%20a%20new%20one%20https://www.Attacker.com%20so%20go%20to%20the%20new%20website%20since%20this%20one\r\n\r\npoc: open the above url and you can notice that text is injected\r\n\r\nFix: Add custom 404 error pages"}}
{"actor":{"display_login":"tiagoalvesdulce"}}