{"action":"opened","issue":{"url":"https://api.github.com/repos/fausecteam/ctf-gameserver/issues/19","repository_url":"https://api.github.com/repos/fausecteam/ctf-gameserver","labels_url":"https://api.github.com/repos/fausecteam/ctf-gameserver/issues/19/labels{/name}","comments_url":"https://api.github.com/repos/fausecteam/ctf-gameserver/issues/19/comments","events_url":"https://api.github.com/repos/fausecteam/ctf-gameserver/issues/19/events","html_url":"https://github.com/fausecteam/ctf-gameserver/issues/19","id":332806783,"node_id":"MDU6SXNzdWUzMzI4MDY3ODM=","number":19,"title":"Web: Better validation of uploaded images","user":{"login":"F30","id":2017238,"node_id":"MDQ6VXNlcjIwMTcyMzg=","avatar_url":"https://avatars2.githubusercontent.com/u/2017238?v=4","gravatar_id":"","url":"https://api.github.com/users/F30","html_url":"https://github.com/F30","followers_url":"https://api.github.com/users/F30/followers","following_url":"https://api.github.com/users/F30/following{/other_user}","gists_url":"https://api.github.com/users/F30/gists{/gist_id}","starred_url":"https://api.github.com/users/F30/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/F30/subscriptions","organizations_url":"https://api.github.com/users/F30/orgs","repos_url":"https://api.github.com/users/F30/repos","events_url":"https://api.github.com/users/F30/events{/privacy}","received_events_url":"https://api.github.com/users/F30/received_events","type":"User","site_admin":false},"labels":[{"id":480705072,"node_id":"MDU6TGFiZWw0ODA3MDUwNzI=","url":"https://api.github.com/repos/fausecteam/ctf-gameserver/labels/bug","name":"bug","color":"ee0701","default":true},{"id":965852956,"node_id":"MDU6TGFiZWw5NjU4NTI5NTY=","url":"https://api.github.com/repos/fausecteam/ctf-gameserver/labels/docs","name":"docs","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-15T14:53:42Z","updated_at":"2018-06-15T14:53:42Z","closed_at":null,"author_association":"MEMBER","body":"We had some security issues with uploaded team images at FAUST CTF 2018, where Cross Site Scripting was possible. There should be validation of the uploaded file extensions and maybe also file contents.\r\n\r\nBesides that, we should add notes about setting `Content-Security-Policy` and maybe using a different domain for uploads in the documentation."}}
{"actor":{"display_login":"F30"}}