{"action":"created","comment":{"url":"https://api.github.com/repos/gitx/gitx/pulls/comments/174603397","pull_request_review_id":103990504,"id":174603397,"diff_hunk":"@@ -4,19 +4,18 @@ var showMultipleFilesSelection = function(files)\n \tsetTitle(\"\");\n \n \tvar div = $(\"diff\");\n+    div.style.display = \"\";\n+\tdiv.innerHTML = '<div id=\"multiselect\">' +","path":"Resources/html/views/commit/multipleSelection.js","position":5,"original_position":5,"commit_id":"4820fdc2d04247e8094e07d075bc049c419443b3","original_commit_id":"5f3975d8cbee760ae5be06acd94774e8037a5891","user":{"login":"tiennou","id":81099,"avatar_url":"https://avatars1.githubusercontent.com/u/81099?v=4","gravatar_id":"","url":"https://api.github.com/users/tiennou","html_url":"https://github.com/tiennou","followers_url":"https://api.github.com/users/tiennou/followers","following_url":"https://api.github.com/users/tiennou/following{/other_user}","gists_url":"https://api.github.com/users/tiennou/gists{/gist_id}","starred_url":"https://api.github.com/users/tiennou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiennou/subscriptions","organizations_url":"https://api.github.com/users/tiennou/orgs","repos_url":"https://api.github.com/users/tiennou/repos","events_url":"https://api.github.com/users/tiennou/events{/privacy}","received_events_url":"https://api.github.com/users/tiennou/received_events","type":"User","site_admin":false},"body":"Ditto","created_at":"2018-03-14T20:42:23Z","updated_at":"2018-03-14T20:46:19Z","html_url":"https://github.com/gitx/gitx/pull/124#discussion_r174603397","pull_request_url":"https://api.github.com/repos/gitx/gitx/pulls/124","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/gitx/gitx/pulls/comments/174603397"},"html":{"href":"https://github.com/gitx/gitx/pull/124#discussion_r174603397"},"pull_request":{"href":"https://api.github.com/repos/gitx/gitx/pulls/124"}}},"pull_request":{"url":"https://api.github.com/repos/gitx/gitx/pulls/124","id":173367866,"html_url":"https://github.com/gitx/gitx/pull/124","diff_url":"https://github.com/gitx/gitx/pull/124.diff","patch_url":"https://github.com/gitx/gitx/pull/124.patch","issue_url":"https://api.github.com/repos/gitx/gitx/issues/124","number":124,"state":"open","locked":false,"title":"Fix and mitigate code injection (XSS) in HTML views","user":{"login":"nanotech","id":34699,"avatar_url":"https://avatars2.githubusercontent.com/u/34699?v=4","gravatar_id":"","url":"https://api.github.com/users/nanotech","html_url":"https://github.com/nanotech","followers_url":"https://api.github.com/users/nanotech/followers","following_url":"https://api.github.com/users/nanotech/following{/other_user}","gists_url":"https://api.github.com/users/nanotech/gists{/gist_id}","starred_url":"https://api.github.com/users/nanotech/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nanotech/subscriptions","organizations_url":"https://api.github.com/users/nanotech/orgs","repos_url":"https://api.github.com/users/nanotech/repos","events_url":"https://api.github.com/users/nanotech/events{/privacy}","received_events_url":"https://api.github.com/users/nanotech/received_events","type":"User","site_admin":false},"body":"It appears that the HTML view code was not originally written with XSS in mind, with nearly all text being interpreted as raw HTML. If a user opens a repository with malicious commits, arbitrary JavaScript could be run.\r\n\r\nI've fixed all of the code injection bugs I could find, and have also added Content-Security-Policy headers to each of the views to mitigate possible remaining or future injection bugs. Inline scripts and styles have been moved into external files as needed.","created_at":"2018-03-07T06:59:07Z","updated_at":"2018-03-14T20:46:19Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d61103b3966376e8412bc815c1660efe10ddf1e3","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/gitx/gitx/pulls/124/commits","review_comments_url":"https://api.github.com/repos/gitx/gitx/pulls/124/comments","review_comment_url":"https://api.github.com/repos/gitx/gitx/pulls/comments{/number}","comments_url":"https://api.github.com/repos/gitx/gitx/issues/124/comments","statuses_url":"https://api.github.com/repos/gitx/gitx/statuses/4820fdc2d04247e8094e07d075bc049c419443b3","head":{"label":"nanotech:xss","ref":"xss","sha":"4820fdc2d04247e8094e07d075bc049c419443b3","user":{"login":"nanotech","id":34699,"avatar_url":"https://avatars2.githubusercontent.com/u/34699?v=4","gravatar_id":"","url":"https://api.github.com/users/nanotech","html_url":"https://github.com/nanotech","followers_url":"https://api.github.com/users/nanotech/followers","following_url":"https://api.github.com/users/nanotech/following{/other_user}","gists_url":"https://api.github.com/users/nanotech/gists{/gist_id}","starred_url":"https://api.github.com/users/nanotech/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nanotech/subscriptions","organizations_url":"https://api.github.com/users/nanotech/orgs","repos_url":"https://api.github.com/users/nanotech/repos","events_url":"https://api.github.com/users/nanotech/events{/privacy}","received_events_url":"https://api.github.com/users/nanotech/received_events","type":"User","site_admin":false},"repo":{"id":83247368,"name":"gitx","full_name":"nanotech/gitx","owner":{"login":"nanotech","id":34699,"avatar_url":"https://avatars2.githubusercontent.com/u/34699?v=4","gravatar_id":"","url":"https://api.github.com/users/nanotech","html_url":"https://github.com/nanotech","followers_url":"https://api.github.com/users/nanotech/followers","following_url":"https://api.github.com/users/nanotech/following{/other_user}","gists_url":"https://api.github.com/users/nanotech/gists{/gist_id}","starred_url":"https://api.github.com/users/nanotech/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nanotech/subscriptions","organizations_url":"https://api.github.com/users/nanotech/orgs","repos_url":"https://api.github.com/users/nanotech/repos","events_url":"https://api.github.com/users/nanotech/events{/privacy}","received_events_url":"https://api.github.com/users/nanotech/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/nanotech/gitx","description":"git GUI for macOS. Current development focus is on removing legacy git command line usage in favour of libgit2 and objective-git.","fork":true,"url":"https://api.github.com/repos/nanotech/gitx","forks_url":"https://api.github.com/repos/nanotech/gitx/forks","keys_url":"https://api.github.com/repos/nanotech/gitx/keys{/key_id}","collaborators_url":"https://api.github.com/repos/nanotech/gitx/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/nanotech/gitx/teams","hooks_url":"https://api.github.com/repos/nanotech/gitx/hooks","issue_events_url":"https://api.github.com/repos/nanotech/gitx/issues/events{/number}","events_url":"https://api.github.com/repos/nanotech/gitx/events","assignees_url":"https://api.github.com/repos/nanotech/gitx/assignees{/user}","branches_url":"https://api.github.com/repos/nanotech/gitx/branches{/branch}","tags_url":"https://api.github.com/repos/nanotech/gitx/tags","blobs_url":"https://api.github.com/repos/nanotech/gitx/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/nanotech/gitx/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/nanotech/gitx/git/refs{/sha}","trees_url":"https://api.github.com/repos/nanotech/gitx/git/trees{/sha}","statuses_url":"https://api.github.com/repos/nanotech/gitx/statuses/{sha}","languages_url":"https://api.github.com/repos/nanotech/gitx/languages","stargazers_url":"https://api.github.com/repos/nanotech/gitx/stargazers","contributors_url":"https://api.github.com/repos/nanotech/gitx/contributors","subscribers_url":"https://api.github.com/repos/nanotech/gitx/subscribers","subscription_url":"https://api.github.com/repos/nanotech/gitx/subscription","commits_url":"https://api.github.com/repos/nanotech/gitx/commits{/sha}","git_commits_url":"https://api.github.com/repos/nanotech/gitx/git/commits{/sha}","comments_url":"https://api.github.com/repos/nanotech/gitx/comments{/number}","issue_comment_url":"https://api.github.com/repos/nanotech/gitx/issues/comments{/number}","contents_url":"https://api.github.com/repos/nanotech/gitx/contents/{+path}","compare_url":"https://api.github.com/repos/nanotech/gitx/compare/{base}...{head}","merges_url":"https://api.github.com/repos/nanotech/gitx/merges","archive_url":"https://api.github.com/repos/nanotech/gitx/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/nanotech/gitx/downloads","issues_url":"https://api.github.com/repos/nanotech/gitx/issues{/number}","pulls_url":"https://api.github.com/repos/nanotech/gitx/pulls{/number}","milestones_url":"https://api.github.com/repos/nanotech/gitx/milestones{/number}","notifications_url":"https://api.github.com/repos/nanotech/gitx/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/nanotech/gitx/labels{/name}","releases_url":"https://api.github.com/repos/nanotech/gitx/releases{/id}","deployments_url":"https://api.github.com/repos/nanotech/gitx/deployments","created_at":"2017-02-26T23:08:36Z","updated_at":"2017-02-26T23:08:38Z","pushed_at":"2018-03-07T06:55:07Z","git_url":"git://github.com/nanotech/gitx.git","ssh_url":"git@github.com:nanotech/gitx.git","clone_url":"https://github.com/nanotech/gitx.git","svn_url":"https://github.com/nanotech/gitx","homepage":"","size":18769,"stargazers_count":0,"watchers_count":0,"language":"Objective-C","has_issues":false,"has_projects":true,"has_downloads":false,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"gitx:master","ref":"master","sha":"1c430c9e0aad3ea4cf9192a62956f91de8087dcf","user":{"login":"gitx","id":8301801,"avatar_url":"https://avatars0.githubusercontent.com/u/8301801?v=4","gravatar_id":"","url":"https://api.github.com/users/gitx","html_url":"https://github.com/gitx","followers_url":"https://api.github.com/users/gitx/followers","following_url":"https://api.github.com/users/gitx/following{/other_user}","gists_url":"https://api.github.com/users/gitx/gists{/gist_id}","starred_url":"https://api.github.com/users/gitx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gitx/subscriptions","organizations_url":"https://api.github.com/users/gitx/orgs","repos_url":"https://api.github.com/users/gitx/repos","events_url":"https://api.github.com/users/gitx/events{/privacy}","received_events_url":"https://api.github.com/users/gitx/received_events","type":"Organization","site_admin":false},"repo":{"id":75876315,"name":"gitx","full_name":"gitx/gitx","owner":{"login":"gitx","id":8301801,"avatar_url":"https://avatars0.githubusercontent.com/u/8301801?v=4","gravatar_id":"","url":"https://api.github.com/users/gitx","html_url":"https://github.com/gitx","followers_url":"https://api.github.com/users/gitx/followers","following_url":"https://api.github.com/users/gitx/following{/other_user}","gists_url":"https://api.github.com/users/gitx/gists{/gist_id}","starred_url":"https://api.github.com/users/gitx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gitx/subscriptions","organizations_url":"https://api.github.com/users/gitx/orgs","repos_url":"https://api.github.com/users/gitx/repos","events_url":"https://api.github.com/users/gitx/events{/privacy}","received_events_url":"https://api.github.com/users/gitx/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/gitx/gitx","description":"git GUI for macOS. Current development focus is on removing legacy git command line usage in favour of libgit2 and objective-git.","fork":true,"url":"https://api.github.com/repos/gitx/gitx","forks_url":"https://api.github.com/repos/gitx/gitx/forks","keys_url":"https://api.github.com/repos/gitx/gitx/keys{/key_id}","collaborators_url":"https://api.github.com/repos/gitx/gitx/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/gitx/gitx/teams","hooks_url":"https://api.github.com/repos/gitx/gitx/hooks","issue_events_url":"https://api.github.com/repos/gitx/gitx/issues/events{/number}","events_url":"https://api.github.com/repos/gitx/gitx/events","assignees_url":"https://api.github.com/repos/gitx/gitx/assignees{/user}","branches_url":"https://api.github.com/repos/gitx/gitx/branches{/branch}","tags_url":"https://api.github.com/repos/gitx/gitx/tags","blobs_url":"https://api.github.com/repos/gitx/gitx/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/gitx/gitx/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/gitx/gitx/git/refs{/sha}","trees_url":"https://api.github.com/repos/gitx/gitx/git/trees{/sha}","statuses_url":"https://api.github.com/repos/gitx/gitx/statuses/{sha}","languages_url":"https://api.github.com/repos/gitx/gitx/languages","stargazers_url":"https://api.github.com/repos/gitx/gitx/stargazers","contributors_url":"https://api.github.com/repos/gitx/gitx/contributors","subscribers_url":"https://api.github.com/repos/gitx/gitx/subscribers","subscription_url":"https://api.github.com/repos/gitx/gitx/subscription","commits_url":"https://api.github.com/repos/gitx/gitx/commits{/sha}","git_commits_url":"https://api.github.com/repos/gitx/gitx/git/commits{/sha}","comments_url":"https://api.github.com/repos/gitx/gitx/comments{/number}","issue_comment_url":"https://api.github.com/repos/gitx/gitx/issues/comments{/number}","contents_url":"https://api.github.com/repos/gitx/gitx/contents/{+path}","compare_url":"https://api.github.com/repos/gitx/gitx/compare/{base}...{head}","merges_url":"https://api.github.com/repos/gitx/gitx/merges","archive_url":"https://api.github.com/repos/gitx/gitx/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/gitx/gitx/downloads","issues_url":"https://api.github.com/repos/gitx/gitx/issues{/number}","pulls_url":"https://api.github.com/repos/gitx/gitx/pulls{/number}","milestones_url":"https://api.github.com/repos/gitx/gitx/milestones{/number}","notifications_url":"https://api.github.com/repos/gitx/gitx/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/gitx/gitx/labels{/name}","releases_url":"https://api.github.com/repos/gitx/gitx/releases{/id}","deployments_url":"https://api.github.com/repos/gitx/gitx/deployments","created_at":"2016-12-07T21:16:03Z","updated_at":"2018-03-14T20:35:50Z","pushed_at":"2018-03-14T20:19:46Z","git_url":"git://github.com/gitx/gitx.git","ssh_url":"git@github.com:gitx/gitx.git","clone_url":"https://github.com/gitx/gitx.git","svn_url":"https://github.com/gitx/gitx","homepage":"","size":19534,"stargazers_count":149,"watchers_count":149,"language":"Objective-C","has_issues":true,"has_projects":true,"has_downloads":false,"has_wiki":true,"has_pages":true,"forks_count":21,"mirror_url":null,"archived":false,"open_issues_count":42,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0"},"forks":21,"open_issues":42,"watchers":149,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/gitx/gitx/pulls/124"},"html":{"href":"https://github.com/gitx/gitx/pull/124"},"issue":{"href":"https://api.github.com/repos/gitx/gitx/issues/124"},"comments":{"href":"https://api.github.com/repos/gitx/gitx/issues/124/comments"},"review_comments":{"href":"https://api.github.com/repos/gitx/gitx/pulls/124/comments"},"review_comment":{"href":"https://api.github.com/repos/gitx/gitx/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/gitx/gitx/pulls/124/commits"},"statuses":{"href":"https://api.github.com/repos/gitx/gitx/statuses/4820fdc2d04247e8094e07d075bc049c419443b3"}},"author_association":"NONE"}}
{"actor":{"display_login":"tiennou"}}