{"action":"created","issue":{"url":"https://api.github.com/repos/infor-design/enterprise/issues/257","repository_url":"https://api.github.com/repos/infor-design/enterprise","labels_url":"https://api.github.com/repos/infor-design/enterprise/issues/257/labels{/name}","comments_url":"https://api.github.com/repos/infor-design/enterprise/issues/257/comments","events_url":"https://api.github.com/repos/infor-design/enterprise/issues/257/events","html_url":"https://github.com/infor-design/enterprise/issues/257","id":335034623,"node_id":"MDU6SXNzdWUzMzUwMzQ2MjM=","number":257,"title":"SOHO-7019: XSS in Editor (Homepages Notes widget)","user":{"login":"clepore","id":742319,"node_id":"MDQ6VXNlcjc0MjMxOQ==","avatar_url":"https://avatars2.githubusercontent.com/u/742319?v=4","gravatar_id":"","url":"https://api.github.com/users/clepore","html_url":"https://github.com/clepore","followers_url":"https://api.github.com/users/clepore/followers","following_url":"https://api.github.com/users/clepore/following{/other_user}","gists_url":"https://api.github.com/users/clepore/gists{/gist_id}","starred_url":"https://api.github.com/users/clepore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clepore/subscriptions","organizations_url":"https://api.github.com/users/clepore/orgs","repos_url":"https://api.github.com/users/clepore/repos","events_url":"https://api.github.com/users/clepore/events{/privacy}","received_events_url":"https://api.github.com/users/clepore/received_events","type":"User","site_admin":false},"labels":[{"id":915011058,"node_id":"MDU6TGFiZWw5MTUwMTEwNTg=","url":"https://api.github.com/repos/infor-design/enterprise/labels/type:%20bug","name":"type: bug","color":"e84f4f","default":false}],"state":"closed","locked":false,"assignee":{"login":"tmcconechy","id":814283,"node_id":"MDQ6VXNlcjgxNDI4Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/814283?v=4","gravatar_id":"","url":"https://api.github.com/users/tmcconechy","html_url":"https://github.com/tmcconechy","followers_url":"https://api.github.com/users/tmcconechy/followers","following_url":"https://api.github.com/users/tmcconechy/following{/other_user}","gists_url":"https://api.github.com/users/tmcconechy/gists{/gist_id}","starred_url":"https://api.github.com/users/tmcconechy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tmcconechy/subscriptions","organizations_url":"https://api.github.com/users/tmcconechy/orgs","repos_url":"https://api.github.com/users/tmcconechy/repos","events_url":"https://api.github.com/users/tmcconechy/events{/privacy}","received_events_url":"https://api.github.com/users/tmcconechy/received_events","type":"User","site_admin":false},"assignees":[{"login":"tmcconechy","id":814283,"node_id":"MDQ6VXNlcjgxNDI4Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/814283?v=4","gravatar_id":"","url":"https://api.github.com/users/tmcconechy","html_url":"https://github.com/tmcconechy","followers_url":"https://api.github.com/users/tmcconechy/followers","following_url":"https://api.github.com/users/tmcconechy/following{/other_user}","gists_url":"https://api.github.com/users/tmcconechy/gists{/gist_id}","starred_url":"https://api.github.com/users/tmcconechy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tmcconechy/subscriptions","organizations_url":"https://api.github.com/users/tmcconechy/orgs","repos_url":"https://api.github.com/users/tmcconechy/repos","events_url":"https://api.github.com/users/tmcconechy/events{/privacy}","received_events_url":"https://api.github.com/users/tmcconechy/received_events","type":"User","site_admin":false},{"login":"deep7102","id":38439203,"node_id":"MDQ6VXNlcjM4NDM5MjAz","avatar_url":"https://avatars0.githubusercontent.com/u/38439203?v=4","gravatar_id":"","url":"https://api.github.com/users/deep7102","html_url":"https://github.com/deep7102","followers_url":"https://api.github.com/users/deep7102/followers","following_url":"https://api.github.com/users/deep7102/following{/other_user}","gists_url":"https://api.github.com/users/deep7102/gists{/gist_id}","starred_url":"https://api.github.com/users/deep7102/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deep7102/subscriptions","organizations_url":"https://api.github.com/users/deep7102/orgs","repos_url":"https://api.github.com/users/deep7102/repos","events_url":"https://api.github.com/users/deep7102/events{/privacy}","received_events_url":"https://api.github.com/users/deep7102/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-06-22T22:16:49Z","updated_at":"2018-08-28T10:51:48Z","closed_at":"2018-08-22T14:33:34Z","author_association":"MEMBER","body":"When using the Notes widget in Homepages (which uses the Editor SoHo component), you can insert script tags in hyperlinks:\r\n!xss_notes.gif|thumbnail!\r\n\r\nThis is pretty dangerous, since it makes it trivial to perform an XSS attack on any platform where users can share the contents of the Editor (assuming no escaping is done when serializing/transmitting the data).\r\n\r\nI guess this affects any product that uses the Editor, and is not specific to Homepages widgets.\r\n\r\n*Stpes to reproduce*\r\n- Go to http://usalvlhlpool1.infor.com/4.4.0-rc/components/editor/example-clickable-links\r\n- Click the insert anchor button.\r\n- Add a link with URL: \"><script>alert()</script>\r\n- Click Insert\r\n- Click the HTML button\r\n_issue occurs here_\r\n\r\nExpected: No alert\r\nActual: Alert appears due to injected script being executed."},"comment":{"url":"https://api.github.com/repos/infor-design/enterprise/issues/comments/416540642","html_url":"https://github.com/infor-design/enterprise/issues/257#issuecomment-416540642","issue_url":"https://api.github.com/repos/infor-design/enterprise/issues/257","id":416540642,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNjU0MDY0Mg==","user":{"login":"brianjuan","id":39508864,"node_id":"MDQ6VXNlcjM5NTA4ODY0","avatar_url":"https://avatars2.githubusercontent.com/u/39508864?v=4","gravatar_id":"","url":"https://api.github.com/users/brianjuan","html_url":"https://github.com/brianjuan","followers_url":"https://api.github.com/users/brianjuan/followers","following_url":"https://api.github.com/users/brianjuan/following{/other_user}","gists_url":"https://api.github.com/users/brianjuan/gists{/gist_id}","starred_url":"https://api.github.com/users/brianjuan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brianjuan/subscriptions","organizations_url":"https://api.github.com/users/brianjuan/orgs","repos_url":"https://api.github.com/users/brianjuan/repos","events_url":"https://api.github.com/users/brianjuan/events{/privacy}","received_events_url":"https://api.github.com/users/brianjuan/received_events","type":"User","site_admin":false},"created_at":"2018-08-28T10:51:48Z","updated_at":"2018-08-28T10:51:48Z","author_association":"NONE","body":"Passed Smoke testing on http://4100-beta0-enterprise.demo.design.infor.com/kitchen-sink\r\n"}}
{"actor":{"display_login":"brianjuan"}}