{"action":"opened","number":746,"pull_request":{"url":"https://api.github.com/repos/typecho/typecho/pulls/746","id":182539555,"html_url":"https://github.com/typecho/typecho/pull/746","diff_url":"https://github.com/typecho/typecho/pull/746.diff","patch_url":"https://github.com/typecho/typecho/pull/746.patch","issue_url":"https://api.github.com/repos/typecho/typecho/issues/746","number":746,"state":"open","locked":false,"title":"improve comment XSS attack protection","user":{"login":"mierhuo","id":9657318,"avatar_url":"https://avatars2.githubusercontent.com/u/9657318?v=4","gravatar_id":"","url":"https://api.github.com/users/mierhuo","html_url":"https://github.com/mierhuo","followers_url":"https://api.github.com/users/mierhuo/followers","following_url":"https://api.github.com/users/mierhuo/following{/other_user}","gists_url":"https://api.github.com/users/mierhuo/gists{/gist_id}","starred_url":"https://api.github.com/users/mierhuo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mierhuo/subscriptions","organizations_url":"https://api.github.com/users/mierhuo/orgs","repos_url":"https://api.github.com/users/mierhuo/repos","events_url":"https://api.github.com/users/mierhuo/events{/privacy}","received_events_url":"https://api.github.com/users/mierhuo/received_events","type":"User","site_admin":false},"body":"评论内容区域可在后台自定义配置允许的HTML标签与其属性，但是基本未对属性内容作任何保护。后台该输入框提示如下：\r\n\r\n> 默认的用户评论不允许填写任何的HTML标签, 你可以在这里填写允许使用的HTML标签.\r\n比如: `<a href=\"\"> <img src=\"\"> <blockquote>`\r\n\r\n如果用户按照提示填入 `<a href=\"\">` 则评论如下内容，即会导致问题：\r\n\r\n```\r\n<a href=\"javascript:alert('xss')\">XSS Test</a>\r\n``` \r\n\r\n在文章后的**评论显示区域**及后台管理界面中的**管理 - 评论界面**，都会产生问题。\r\n\r\n鉴于常用的几个标签里面只有 `href` 属性会导致这个问题，且不考虑类似主动开放 `<script>` 标签的行为，应当对其进行防御。根据 `Typecho_Common::__parseAttrs()` 的解析流程及边界情况，只需要利用 `Typecho_Validate::url()` 对去掉包裹的引号的属性值进行判定即可，这样也禁掉了其他方式可能会被采用 Unicode 字符编码绕过的问题，而正常用户不会以字符编码形式输入所以无影响。\r\n\r\n感觉允许评论区域插入链接的老哥应该还是不少的...","created_at":"2018-04-18T16:45:11Z","updated_at":"2018-04-18T16:45:11Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/typecho/typecho/pulls/746/commits","review_comments_url":"https://api.github.com/repos/typecho/typecho/pulls/746/comments","review_comment_url":"https://api.github.com/repos/typecho/typecho/pulls/comments{/number}","comments_url":"https://api.github.com/repos/typecho/typecho/issues/746/comments","statuses_url":"https://api.github.com/repos/typecho/typecho/statuses/dbc7d4cf8064582e971dae41ce46eed75d68c2cc","head":{"label":"mierhuo:master","ref":"master","sha":"dbc7d4cf8064582e971dae41ce46eed75d68c2cc","user":{"login":"mierhuo","id":9657318,"avatar_url":"https://avatars2.githubusercontent.com/u/9657318?v=4","gravatar_id":"","url":"https://api.github.com/users/mierhuo","html_url":"https://github.com/mierhuo","followers_url":"https://api.github.com/users/mierhuo/followers","following_url":"https://api.github.com/users/mierhuo/following{/other_user}","gists_url":"https://api.github.com/users/mierhuo/gists{/gist_id}","starred_url":"https://api.github.com/users/mierhuo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mierhuo/subscriptions","organizations_url":"https://api.github.com/users/mierhuo/orgs","repos_url":"https://api.github.com/users/mierhuo/repos","events_url":"https://api.github.com/users/mierhuo/events{/privacy}","received_events_url":"https://api.github.com/users/mierhuo/received_events","type":"User","site_admin":false},"repo":{"id":130078563,"name":"typecho","full_name":"mierhuo/typecho","owner":{"login":"mierhuo","id":9657318,"avatar_url":"https://avatars2.githubusercontent.com/u/9657318?v=4","gravatar_id":"","url":"https://api.github.com/users/mierhuo","html_url":"https://github.com/mierhuo","followers_url":"https://api.github.com/users/mierhuo/followers","following_url":"https://api.github.com/users/mierhuo/following{/other_user}","gists_url":"https://api.github.com/users/mierhuo/gists{/gist_id}","starred_url":"https://api.github.com/users/mierhuo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mierhuo/subscriptions","organizations_url":"https://api.github.com/users/mierhuo/orgs","repos_url":"https://api.github.com/users/mierhuo/repos","events_url":"https://api.github.com/users/mierhuo/events{/privacy}","received_events_url":"https://api.github.com/users/mierhuo/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mierhuo/typecho","description":"A PHP Blogging Platform. Simple and Powerful.","fork":true,"url":"https://api.github.com/repos/mierhuo/typecho","forks_url":"https://api.github.com/repos/mierhuo/typecho/forks","keys_url":"https://api.github.com/repos/mierhuo/typecho/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mierhuo/typecho/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mierhuo/typecho/teams","hooks_url":"https://api.github.com/repos/mierhuo/typecho/hooks","issue_events_url":"https://api.github.com/repos/mierhuo/typecho/issues/events{/number}","events_url":"https://api.github.com/repos/mierhuo/typecho/events","assignees_url":"https://api.github.com/repos/mierhuo/typecho/assignees{/user}","branches_url":"https://api.github.com/repos/mierhuo/typecho/branches{/branch}","tags_url":"https://api.github.com/repos/mierhuo/typecho/tags","blobs_url":"https://api.github.com/repos/mierhuo/typecho/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mierhuo/typecho/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mierhuo/typecho/git/refs{/sha}","trees_url":"https://api.github.com/repos/mierhuo/typecho/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mierhuo/typecho/statuses/{sha}","languages_url":"https://api.github.com/repos/mierhuo/typecho/languages","stargazers_url":"https://api.github.com/repos/mierhuo/typecho/stargazers","contributors_url":"https://api.github.com/repos/mierhuo/typecho/contributors","subscribers_url":"https://api.github.com/repos/mierhuo/typecho/subscribers","subscription_url":"https://api.github.com/repos/mierhuo/typecho/subscription","commits_url":"https://api.github.com/repos/mierhuo/typecho/commits{/sha}","git_commits_url":"https://api.github.com/repos/mierhuo/typecho/git/commits{/sha}","comments_url":"https://api.github.com/repos/mierhuo/typecho/comments{/number}","issue_comment_url":"https://api.github.com/repos/mierhuo/typecho/issues/comments{/number}","contents_url":"https://api.github.com/repos/mierhuo/typecho/contents/{+path}","compare_url":"https://api.github.com/repos/mierhuo/typecho/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mierhuo/typecho/merges","archive_url":"https://api.github.com/repos/mierhuo/typecho/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mierhuo/typecho/downloads","issues_url":"https://api.github.com/repos/mierhuo/typecho/issues{/number}","pulls_url":"https://api.github.com/repos/mierhuo/typecho/pulls{/number}","milestones_url":"https://api.github.com/repos/mierhuo/typecho/milestones{/number}","notifications_url":"https://api.github.com/repos/mierhuo/typecho/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mierhuo/typecho/labels{/name}","releases_url":"https://api.github.com/repos/mierhuo/typecho/releases{/id}","deployments_url":"https://api.github.com/repos/mierhuo/typecho/deployments","created_at":"2018-04-18T14:53:27Z","updated_at":"2018-04-18T16:00:59Z","pushed_at":"2018-04-18T16:00:56Z","git_url":"git://github.com/mierhuo/typecho.git","ssh_url":"git@github.com:mierhuo/typecho.git","clone_url":"https://github.com/mierhuo/typecho.git","svn_url":"https://github.com/mierhuo/typecho","homepage":"http://typecho.org","size":7940,"stargazers_count":0,"watchers_count":0,"language":"PHP","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"typecho:master","ref":"master","sha":"6530443e4146e1f91b14b6b72df3f67ad594389c","user":{"login":"typecho","id":2030842,"avatar_url":"https://avatars2.githubusercontent.com/u/2030842?v=4","gravatar_id":"","url":"https://api.github.com/users/typecho","html_url":"https://github.com/typecho","followers_url":"https://api.github.com/users/typecho/followers","following_url":"https://api.github.com/users/typecho/following{/other_user}","gists_url":"https://api.github.com/users/typecho/gists{/gist_id}","starred_url":"https://api.github.com/users/typecho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/typecho/subscriptions","organizations_url":"https://api.github.com/users/typecho/orgs","repos_url":"https://api.github.com/users/typecho/repos","events_url":"https://api.github.com/users/typecho/events{/privacy}","received_events_url":"https://api.github.com/users/typecho/received_events","type":"Organization","site_admin":false},"repo":{"id":11467667,"name":"typecho","full_name":"typecho/typecho","owner":{"login":"typecho","id":2030842,"avatar_url":"https://avatars2.githubusercontent.com/u/2030842?v=4","gravatar_id":"","url":"https://api.github.com/users/typecho","html_url":"https://github.com/typecho","followers_url":"https://api.github.com/users/typecho/followers","following_url":"https://api.github.com/users/typecho/following{/other_user}","gists_url":"https://api.github.com/users/typecho/gists{/gist_id}","starred_url":"https://api.github.com/users/typecho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/typecho/subscriptions","organizations_url":"https://api.github.com/users/typecho/orgs","repos_url":"https://api.github.com/users/typecho/repos","events_url":"https://api.github.com/users/typecho/events{/privacy}","received_events_url":"https://api.github.com/users/typecho/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/typecho/typecho","description":"A PHP Blogging Platform. Simple and Powerful.","fork":false,"url":"https://api.github.com/repos/typecho/typecho","forks_url":"https://api.github.com/repos/typecho/typecho/forks","keys_url":"https://api.github.com/repos/typecho/typecho/keys{/key_id}","collaborators_url":"https://api.github.com/repos/typecho/typecho/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/typecho/typecho/teams","hooks_url":"https://api.github.com/repos/typecho/typecho/hooks","issue_events_url":"https://api.github.com/repos/typecho/typecho/issues/events{/number}","events_url":"https://api.github.com/repos/typecho/typecho/events","assignees_url":"https://api.github.com/repos/typecho/typecho/assignees{/user}","branches_url":"https://api.github.com/repos/typecho/typecho/branches{/branch}","tags_url":"https://api.github.com/repos/typecho/typecho/tags","blobs_url":"https://api.github.com/repos/typecho/typecho/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/typecho/typecho/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/typecho/typecho/git/refs{/sha}","trees_url":"https://api.github.com/repos/typecho/typecho/git/trees{/sha}","statuses_url":"https://api.github.com/repos/typecho/typecho/statuses/{sha}","languages_url":"https://api.github.com/repos/typecho/typecho/languages","stargazers_url":"https://api.github.com/repos/typecho/typecho/stargazers","contributors_url":"https://api.github.com/repos/typecho/typecho/contributors","subscribers_url":"https://api.github.com/repos/typecho/typecho/subscribers","subscription_url":"https://api.github.com/repos/typecho/typecho/subscription","commits_url":"https://api.github.com/repos/typecho/typecho/commits{/sha}","git_commits_url":"https://api.github.com/repos/typecho/typecho/git/commits{/sha}","comments_url":"https://api.github.com/repos/typecho/typecho/comments{/number}","issue_comment_url":"https://api.github.com/repos/typecho/typecho/issues/comments{/number}","contents_url":"https://api.github.com/repos/typecho/typecho/contents/{+path}","compare_url":"https://api.github.com/repos/typecho/typecho/compare/{base}...{head}","merges_url":"https://api.github.com/repos/typecho/typecho/merges","archive_url":"https://api.github.com/repos/typecho/typecho/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/typecho/typecho/downloads","issues_url":"https://api.github.com/repos/typecho/typecho/issues{/number}","pulls_url":"https://api.github.com/repos/typecho/typecho/pulls{/number}","milestones_url":"https://api.github.com/repos/typecho/typecho/milestones{/number}","notifications_url":"https://api.github.com/repos/typecho/typecho/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/typecho/typecho/labels{/name}","releases_url":"https://api.github.com/repos/typecho/typecho/releases{/id}","deployments_url":"https://api.github.com/repos/typecho/typecho/deployments","created_at":"2013-07-17T05:08:35Z","updated_at":"2018-04-18T15:04:22Z","pushed_at":"2018-03-29T01:53:51Z","git_url":"git://github.com/typecho/typecho.git","ssh_url":"git@github.com:typecho/typecho.git","clone_url":"https://github.com/typecho/typecho.git","svn_url":"https://github.com/typecho/typecho","homepage":"http://typecho.org","size":7940,"stargazers_count":4301,"watchers_count":4301,"language":"PHP","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1086,"mirror_url":null,"archived":false,"open_issues_count":204,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0"},"forks":1086,"open_issues":204,"watchers":4301,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/typecho/typecho/pulls/746"},"html":{"href":"https://github.com/typecho/typecho/pull/746"},"issue":{"href":"https://api.github.com/repos/typecho/typecho/issues/746"},"comments":{"href":"https://api.github.com/repos/typecho/typecho/issues/746/comments"},"review_comments":{"href":"https://api.github.com/repos/typecho/typecho/pulls/746/comments"},"review_comment":{"href":"https://api.github.com/repos/typecho/typecho/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/typecho/typecho/pulls/746/commits"},"statuses":{"href":"https://api.github.com/repos/typecho/typecho/statuses/dbc7d4cf8064582e971dae41ce46eed75d68c2cc"}},"author_association":"CONTRIBUTOR","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":true,"commits":1,"additions":3,"deletions":1,"changed_files":1}}
{"actor":{"display_login":"mierhuo"}}