{"action":"created","issue":{"url":"https://api.github.com/repos/jquery/jquery/issues/3952","repository_url":"https://api.github.com/repos/jquery/jquery","labels_url":"https://api.github.com/repos/jquery/jquery/issues/3952/labels{/name}","comments_url":"https://api.github.com/repos/jquery/jquery/issues/3952/comments","events_url":"https://api.github.com/repos/jquery/jquery/issues/3952/events","html_url":"https://github.com/jquery/jquery/issues/3952","id":290995995,"number":3952,"title":"pattern.exec run against non sanitized string returned by the server","user":{"login":"pjwalmsley","id":3832357,"avatar_url":"https://avatars0.githubusercontent.com/u/3832357?v=4","gravatar_id":"","url":"https://api.github.com/users/pjwalmsley","html_url":"https://github.com/pjwalmsley","followers_url":"https://api.github.com/users/pjwalmsley/followers","following_url":"https://api.github.com/users/pjwalmsley/following{/other_user}","gists_url":"https://api.github.com/users/pjwalmsley/gists{/gist_id}","starred_url":"https://api.github.com/users/pjwalmsley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pjwalmsley/subscriptions","organizations_url":"https://api.github.com/users/pjwalmsley/orgs","repos_url":"https://api.github.com/users/pjwalmsley/repos","events_url":"https://api.github.com/users/pjwalmsley/events{/privacy}","received_events_url":"https://api.github.com/users/pjwalmsley/received_events","type":"User","site_admin":false},"labels":[{"id":133727374,"url":"https://api.github.com/repos/jquery/jquery/labels/Needs%20info","name":"Needs info","color":"000000","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-01-23T21:17:19Z","updated_at":"2018-03-08T22:14:54Z","closed_at":"2018-03-08T22:14:54Z","author_association":"NONE","body":"This venerability exists within the jQuery library within the ajax component. The third parameter of the callback will be a jqXHR object with a method getResponseHeader. This method may be called with a key (such as 'Connection') to access response headers.  In parsing the headers, this method calls exec on responseHeadersString without sanitizing the string.  \r\n\r\nhttps://github.com/jquery/jquery/blob/master/src/ajax.js#L461\r\n\r\nIf a client were to reach out to a third party service or a man in the middle attack were to be performed, malicious code contained in headers could be executed on the client machine.  \r\n\r\nIn practice this vulnerability is blocked by modern browsers (eg. Chrome, Firefox, and Safari). \r\n A message is put on the console reading \"The page at https://localhost/7000/home/quote was not allowed to display insecure content from XXXX.\""},"comment":{"url":"https://api.github.com/repos/jquery/jquery/issues/comments/371643043","html_url":"https://github.com/jquery/jquery/issues/3952#issuecomment-371643043","issue_url":"https://api.github.com/repos/jquery/jquery/issues/3952","id":371643043,"user":{"login":"dmethvin","id":157858,"avatar_url":"https://avatars2.githubusercontent.com/u/157858?v=4","gravatar_id":"","url":"https://api.github.com/users/dmethvin","html_url":"https://github.com/dmethvin","followers_url":"https://api.github.com/users/dmethvin/followers","following_url":"https://api.github.com/users/dmethvin/following{/other_user}","gists_url":"https://api.github.com/users/dmethvin/gists{/gist_id}","starred_url":"https://api.github.com/users/dmethvin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmethvin/subscriptions","organizations_url":"https://api.github.com/users/dmethvin/orgs","repos_url":"https://api.github.com/users/dmethvin/repos","events_url":"https://api.github.com/users/dmethvin/events{/privacy}","received_events_url":"https://api.github.com/users/dmethvin/received_events","type":"User","site_admin":false},"created_at":"2018-03-08T22:14:54Z","updated_at":"2018-03-08T22:14:54Z","author_association":"OWNER","body":"This can be reopened if there is a test case. I'm not sure how `RegExp.exec` manages to execute malicious code."}}
{"actor":{"display_login":"dmethvin"}}