{"action":"created","issue":{"url":"https://api.github.com/repos/erusev/parsedown/issues/495","repository_url":"https://api.github.com/repos/erusev/parsedown","labels_url":"https://api.github.com/repos/erusev/parsedown/issues/495/labels{/name}","comments_url":"https://api.github.com/repos/erusev/parsedown/issues/495/comments","events_url":"https://api.github.com/repos/erusev/parsedown/issues/495/events","html_url":"https://github.com/erusev/parsedown/pull/495","id":225375951,"number":495,"title":"Prevent various XSS attacks [rebase and update of #276]","user":{"login":"aidantwoods","id":3288888,"avatar_url":"https://avatars1.githubusercontent.com/u/3288888?v=4","gravatar_id":"","url":"https://api.github.com/users/aidantwoods","html_url":"https://github.com/aidantwoods","followers_url":"https://api.github.com/users/aidantwoods/followers","following_url":"https://api.github.com/users/aidantwoods/following{/other_user}","gists_url":"https://api.github.com/users/aidantwoods/gists{/gist_id}","starred_url":"https://api.github.com/users/aidantwoods/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aidantwoods/subscriptions","organizations_url":"https://api.github.com/users/aidantwoods/orgs","repos_url":"https://api.github.com/users/aidantwoods/repos","events_url":"https://api.github.com/users/aidantwoods/events{/privacy}","received_events_url":"https://api.github.com/users/aidantwoods/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":70,"created_at":"2017-05-01T02:47:24Z","updated_at":"2018-02-28T12:04:18Z","closed_at":"2018-02-28T11:41:38Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/erusev/parsedown/pulls/495","html_url":"https://github.com/erusev/parsedown/pull/495","diff_url":"https://github.com/erusev/parsedown/pull/495.diff","patch_url":"https://github.com/erusev/parsedown/pull/495.patch"},"body":"I've picked up on the work started over at https://github.com/erusev/parsedown/pull/276 and rebased on `erusev/master`.\r\n\r\nSince this is rebased on master, I can't point at PR at `naNuke/master` without running into the merge conflicts that I've already resolved manually.\r\n\r\nI've implemented what I suggested [earlier](https://github.com/erusev/parsedown/pull/276#issuecomment-298244798) so that all attributes are properly encoded (and not just the specific ones we remember).\r\n\r\nI've also added some tests, so @erusev's concern here should hopefully now be resolved, albeit a year later 😉 \r\nhttps://github.com/erusev/parsedown/pull/276#issuecomment-178577968\r\n> @malas one reason is the lack of tests\r\n\r\n~~One thing to note is that all this can be circumvented if you forget to turn on `$Parsedown->setMarkupEscaped(true);`\r\n(which is off by default) as you could just write a script tag manually for xss (even though the attributes and link destinations will be safe). So let's all remember to enable this setting 😉~~\r\n\r\nAttributes are now always escaped properly (this speaks to just outputting things correctly), but link based XSS or XSS from writing plain old script tags will only be prevented only if the new `setSafeMode` is enabled.\r\n\r\n```php\r\n$Parsedown->setSafeMode(true);\r\n```\r\n\r\n---\r\n\r\nCloses #161\r\nCloses #497\r\nCloses #276\r\nCloses #403 \r\nCloses #530"},"comment":{"url":"https://api.github.com/repos/erusev/parsedown/issues/comments/369219166","html_url":"https://github.com/erusev/parsedown/pull/495#issuecomment-369219166","issue_url":"https://api.github.com/repos/erusev/parsedown/issues/495","id":369219166,"user":{"login":"dregad","id":449891,"avatar_url":"https://avatars1.githubusercontent.com/u/449891?v=4","gravatar_id":"","url":"https://api.github.com/users/dregad","html_url":"https://github.com/dregad","followers_url":"https://api.github.com/users/dregad/followers","following_url":"https://api.github.com/users/dregad/following{/other_user}","gists_url":"https://api.github.com/users/dregad/gists{/gist_id}","starred_url":"https://api.github.com/users/dregad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dregad/subscriptions","organizations_url":"https://api.github.com/users/dregad/orgs","repos_url":"https://api.github.com/users/dregad/repos","events_url":"https://api.github.com/users/dregad/events{/privacy}","received_events_url":"https://api.github.com/users/dregad/received_events","type":"User","site_admin":false},"created_at":"2018-02-28T12:04:18Z","updated_at":"2018-02-28T12:04:18Z","author_association":"NONE","body":"@erusev Thank you, and as a next step if you could have a look at #553 and do the same for the other PR's as well it would be awesome !"}}
{"actor":{"display_login":"dregad"}}