{"action":"created","issue":{"url":"https://api.github.com/repos/Custodela/NodeGoat/issues/9","repository_url":"https://api.github.com/repos/Custodela/NodeGoat","labels_url":"https://api.github.com/repos/Custodela/NodeGoat/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/Custodela/NodeGoat/issues/9/comments","events_url":"https://api.github.com/repos/Custodela/NodeGoat/issues/9/events","html_url":"https://github.com/Custodela/NodeGoat/issues/9","id":359668755,"node_id":"MDU6SXNzdWUzNTk2Njg3NTU=","number":9,"title":"CX Stored_XSS @ app/data/contributions-dao.js [master]","user":{"login":"kmcdon83","id":8419192,"node_id":"MDQ6VXNlcjg0MTkxOTI=","avatar_url":"https://avatars0.githubusercontent.com/u/8419192?v=4","gravatar_id":"","url":"https://api.github.com/users/kmcdon83","html_url":"https://github.com/kmcdon83","followers_url":"https://api.github.com/users/kmcdon83/followers","following_url":"https://api.github.com/users/kmcdon83/following{/other_user}","gists_url":"https://api.github.com/users/kmcdon83/gists{/gist_id}","starred_url":"https://api.github.com/users/kmcdon83/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kmcdon83/subscriptions","organizations_url":"https://api.github.com/users/kmcdon83/orgs","repos_url":"https://api.github.com/users/kmcdon83/repos","events_url":"https://api.github.com/users/kmcdon83/events{/privacy}","received_events_url":"https://api.github.com/users/kmcdon83/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-12T22:01:24Z","updated_at":"2018-09-12T22:14:39Z","closed_at":null,"author_association":"NONE","body":"**Stored_XSS** issue exists @ **app/data/contributions-dao.js** in branch **master**\r\n\r\n*Method function at line 60 of app\\data\\contributions-dao.js gets data from the database, for the contributions element. This element&#8217;s value then flows through the code without being properly filtered or encoded and is eventually displayed to the user in method contributionsDAO.getByUserId at line 12 of app\\routes\\contributions.js. This may enable a Stored Cross-Site-Scripting attack.*\r\n\r\nSeverity: High\r\nCWE:79\r\n[Vulnerability details and guidance](https://cwe.mitre.org/data/definitions/79.html)\r\nLines: [60](https://github.com/Custodela/NodeGoat//blob/master/app/data/contributions-dao.js#L60) \r\n\r\n---\r\n[Code (Line #60):](https://github.com/Custodela/NodeGoat//blob/master/app/data/contributions-dao.js#L60)\r\n```\r\n            function(err, contributions) {\r\n```\r\n---\r\n"},"comment":{"url":"https://api.github.com/repos/Custodela/NodeGoat/issues/comments/420815626","html_url":"https://github.com/Custodela/NodeGoat/issues/9#issuecomment-420815626","issue_url":"https://api.github.com/repos/Custodela/NodeGoat/issues/9","id":420815626,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDgxNTYyNg==","user":{"login":"kmcdon83","id":8419192,"node_id":"MDQ6VXNlcjg0MTkxOTI=","avatar_url":"https://avatars0.githubusercontent.com/u/8419192?v=4","gravatar_id":"","url":"https://api.github.com/users/kmcdon83","html_url":"https://github.com/kmcdon83","followers_url":"https://api.github.com/users/kmcdon83/followers","following_url":"https://api.github.com/users/kmcdon83/following{/other_user}","gists_url":"https://api.github.com/users/kmcdon83/gists{/gist_id}","starred_url":"https://api.github.com/users/kmcdon83/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kmcdon83/subscriptions","organizations_url":"https://api.github.com/users/kmcdon83/orgs","repos_url":"https://api.github.com/users/kmcdon83/repos","events_url":"https://api.github.com/users/kmcdon83/events{/privacy}","received_events_url":"https://api.github.com/users/kmcdon83/received_events","type":"User","site_admin":false},"created_at":"2018-09-12T22:14:39Z","updated_at":"2018-09-12T22:14:39Z","author_association":"NONE","body":"Issue still exists. "}}
{"actor":{"display_login":"kmcdon83"}}