{"action":"created","issue":{"url":"https://api.github.com/repos/flavorjones/loofah/issues/140","repository_url":"https://api.github.com/repos/flavorjones/loofah","labels_url":"https://api.github.com/repos/flavorjones/loofah/issues/140/labels{/name}","comments_url":"https://api.github.com/repos/flavorjones/loofah/issues/140/comments","events_url":"https://api.github.com/repos/flavorjones/loofah/issues/140/events","html_url":"https://github.com/flavorjones/loofah/issues/140","id":291955422,"number":140,"title":"Add to README: Does not have the Nokogiri XXE DTDLOAD/NONET vulnerability","user":{"login":"david-a-wheeler","id":813150,"avatar_url":"https://avatars0.githubusercontent.com/u/813150?v=4","gravatar_id":"","url":"https://api.github.com/users/david-a-wheeler","html_url":"https://github.com/david-a-wheeler","followers_url":"https://api.github.com/users/david-a-wheeler/followers","following_url":"https://api.github.com/users/david-a-wheeler/following{/other_user}","gists_url":"https://api.github.com/users/david-a-wheeler/gists{/gist_id}","starred_url":"https://api.github.com/users/david-a-wheeler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/david-a-wheeler/subscriptions","organizations_url":"https://api.github.com/users/david-a-wheeler/orgs","repos_url":"https://api.github.com/users/david-a-wheeler/repos","events_url":"https://api.github.com/users/david-a-wheeler/events{/privacy}","received_events_url":"https://api.github.com/users/david-a-wheeler/received_events","type":"User","site_admin":false},"labels":[{"id":749025245,"url":"https://api.github.com/repos/flavorjones/loofah/labels/discussion","name":"discussion","color":"094268","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-01-26T16:25:05Z","updated_at":"2018-02-03T22:25:42Z","closed_at":"2018-02-03T22:25:42Z","author_association":"NONE","body":"As you know, Nokogiri gem can analyze HTML and XML.  Nokogiri can be used in a dangerous way if DTDLOAD is enabled and NONET is disabled (this enables XXE attacks), and some tools are thus reporting Loofah as a potential security vulnerability because it uses Nokogiri.\r\n\r\nAs far as I can tell, loofah never enables DTDLOAD, and it never disables NONET, so loofah doesn't use Nokogiri in an insecure way.\r\n\r\nIf that's true, please add something about that in the loofah README, e.g.:\r\n\r\n> Some tools may incorrectly report loofah is a potential security vulnerability.  Loofah depends on Nokogiri, and it's possible to use Nokogiri in a dangerous way (by enabling its DTDLOAD option and disabling its NONET option).  This dangerous Nokogiri configuration, which is sometimes used by other components, can create an XML External Entity (XXE) vulnerability if the XML data is not trusted. However, loofah never creates this dangerous configuration; loofah never enables DTDLOAD, and it never disables NONET."},"comment":{"url":"https://api.github.com/repos/flavorjones/loofah/issues/comments/362859853","html_url":"https://github.com/flavorjones/loofah/issues/140#issuecomment-362859853","issue_url":"https://api.github.com/repos/flavorjones/loofah/issues/140","id":362859853,"user":{"login":"flavorjones","id":8207,"avatar_url":"https://avatars1.githubusercontent.com/u/8207?v=4","gravatar_id":"","url":"https://api.github.com/users/flavorjones","html_url":"https://github.com/flavorjones","followers_url":"https://api.github.com/users/flavorjones/followers","following_url":"https://api.github.com/users/flavorjones/following{/other_user}","gists_url":"https://api.github.com/users/flavorjones/gists{/gist_id}","starred_url":"https://api.github.com/users/flavorjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flavorjones/subscriptions","organizations_url":"https://api.github.com/users/flavorjones/orgs","repos_url":"https://api.github.com/users/flavorjones/repos","events_url":"https://api.github.com/users/flavorjones/events{/privacy}","received_events_url":"https://api.github.com/users/flavorjones/received_events","type":"User","site_admin":false},"created_at":"2018-02-03T22:25:42Z","updated_at":"2018-02-03T22:25:42Z","author_association":"OWNER","body":"Fair enough. I'll merge #141, and thank you so much for talking this through. And thank you for contributing a PR!"}}
{"actor":{"display_login":"flavorjones"}}