{"action":"created","issue":{"url":"https://api.github.com/repos/WordPress/gutenberg/issues/11520","repository_url":"https://api.github.com/repos/WordPress/gutenberg","labels_url":"https://api.github.com/repos/WordPress/gutenberg/issues/11520/labels{/name}","comments_url":"https://api.github.com/repos/WordPress/gutenberg/issues/11520/comments","events_url":"https://api.github.com/repos/WordPress/gutenberg/issues/11520/events","html_url":"https://github.com/WordPress/gutenberg/issues/11520","id":377648623,"node_id":"MDU6SXNzdWUzNzc2NDg2MjM=","number":11520,"title":"XSS attack possible inside links in paragraph block","user":{"login":"thatdevgirl","id":5687778,"node_id":"MDQ6VXNlcjU2ODc3Nzg=","avatar_url":"https://avatars0.githubusercontent.com/u/5687778?v=4","gravatar_id":"","url":"https://api.github.com/users/thatdevgirl","html_url":"https://github.com/thatdevgirl","followers_url":"https://api.github.com/users/thatdevgirl/followers","following_url":"https://api.github.com/users/thatdevgirl/following{/other_user}","gists_url":"https://api.github.com/users/thatdevgirl/gists{/gist_id}","starred_url":"https://api.github.com/users/thatdevgirl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thatdevgirl/subscriptions","organizations_url":"https://api.github.com/users/thatdevgirl/orgs","repos_url":"https://api.github.com/users/thatdevgirl/repos","events_url":"https://api.github.com/users/thatdevgirl/events{/privacy}","received_events_url":"https://api.github.com/users/thatdevgirl/received_events","type":"User","site_admin":false},"labels":[{"id":630674253,"node_id":"MDU6TGFiZWw2MzA2NzQyNTM=","url":"https://api.github.com/repos/WordPress/gutenberg/labels/[Status]%20Needs%20More%20Info","name":"[Status] Needs More Info","color":"0052cc","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-11-06T00:58:12Z","updated_at":"2018-11-06T10:35:50Z","closed_at":"2018-11-06T10:35:50Z","author_association":"NONE","body":"**Describe the bug**\r\nIt is possible to inject Javascript code inside a link's href in the paragraph block.\r\n\r\n**To Reproduce**\r\n\r\n- Create a page or post with a paragraph block.\r\n- Inside that paragraph block, insert HTML code with a link whose href attribute contains JS code. For example:\r\n\r\n```\r\nHere is some text.\r\n<a href=\"javascript:alert('hello world!')\">Click me</a>\r\n```\r\n\r\n- Note that the link renders inside the editor.\r\n- Save and view the page.\r\n- Click on the link. The Javascript runs.\r\n\r\n**Expected behavior**\r\n\r\nThe JS code inside the `href` attribute should be stripped out.\r\n\r\n**Additional context**\r\n\r\n- The block does strip out `<script>` tags.\r\n- Tested on Gutenberg 4.1.1\r\n"},"comment":{"url":"https://api.github.com/repos/WordPress/gutenberg/issues/comments/436207233","html_url":"https://github.com/WordPress/gutenberg/issues/11520#issuecomment-436207233","issue_url":"https://api.github.com/repos/WordPress/gutenberg/issues/11520","id":436207233,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNjIwNzIzMw==","user":{"login":"tofumatt","id":90871,"node_id":"MDQ6VXNlcjkwODcx","avatar_url":"https://avatars2.githubusercontent.com/u/90871?v=4","gravatar_id":"","url":"https://api.github.com/users/tofumatt","html_url":"https://github.com/tofumatt","followers_url":"https://api.github.com/users/tofumatt/followers","following_url":"https://api.github.com/users/tofumatt/following{/other_user}","gists_url":"https://api.github.com/users/tofumatt/gists{/gist_id}","starred_url":"https://api.github.com/users/tofumatt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tofumatt/subscriptions","organizations_url":"https://api.github.com/users/tofumatt/orgs","repos_url":"https://api.github.com/users/tofumatt/repos","events_url":"https://api.github.com/users/tofumatt/events{/privacy}","received_events_url":"https://api.github.com/users/tofumatt/received_events","type":"User","site_admin":false},"created_at":"2018-11-06T10:35:50Z","updated_at":"2018-11-06T10:35:50Z","author_association":"MEMBER","body":"Unless this is happening as an author or contributor role this is working as expected.\r\n\r\nI think it'd be nice if we didn't allow this so easily, but that's less-to-do with Gutenberg and more with how WordPress as a whole allows admins to post content. 🤷‍♂️\r\n\r\nPlease re-open this though, if it was happening with a user role that shouldn't be allowed to post JS in text."}}
{"actor":{"display_login":"tofumatt"}}