{"action":"created","issue":{"url":"https://api.github.com/repos/onur/docs.rs/issues/167","repository_url":"https://api.github.com/repos/onur/docs.rs","labels_url":"https://api.github.com/repos/onur/docs.rs/issues/167/labels{/name}","comments_url":"https://api.github.com/repos/onur/docs.rs/issues/167/comments","events_url":"https://api.github.com/repos/onur/docs.rs/issues/167/events","html_url":"https://github.com/onur/docs.rs/issues/167","id":274998873,"number":167,"title":"XSS vulnerability found","user":{"login":"Xaeroxe","id":6182002,"avatar_url":"https://avatars3.githubusercontent.com/u/6182002?v=4","gravatar_id":"","url":"https://api.github.com/users/Xaeroxe","html_url":"https://github.com/Xaeroxe","followers_url":"https://api.github.com/users/Xaeroxe/followers","following_url":"https://api.github.com/users/Xaeroxe/following{/other_user}","gists_url":"https://api.github.com/users/Xaeroxe/gists{/gist_id}","starred_url":"https://api.github.com/users/Xaeroxe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Xaeroxe/subscriptions","organizations_url":"https://api.github.com/users/Xaeroxe/orgs","repos_url":"https://api.github.com/users/Xaeroxe/repos","events_url":"https://api.github.com/users/Xaeroxe/events{/privacy}","received_events_url":"https://api.github.com/users/Xaeroxe/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2017-11-17T21:16:35Z","updated_at":"2018-03-14T20:23:30Z","closed_at":null,"author_association":"NONE","body":"https://docs.rs/pwnies\r\n\r\nWhile hilarious, this should probably be fixed."},"comment":{"url":"https://api.github.com/repos/onur/docs.rs/issues/comments/373161996","html_url":"https://github.com/onur/docs.rs/issues/167#issuecomment-373161996","issue_url":"https://api.github.com/repos/onur/docs.rs/issues/167","id":373161996,"user":{"login":"april","id":230528,"avatar_url":"https://avatars2.githubusercontent.com/u/230528?v=4","gravatar_id":"","url":"https://api.github.com/users/april","html_url":"https://github.com/april","followers_url":"https://api.github.com/users/april/followers","following_url":"https://api.github.com/users/april/following{/other_user}","gists_url":"https://api.github.com/users/april/gists{/gist_id}","starred_url":"https://api.github.com/users/april/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/april/subscriptions","organizations_url":"https://api.github.com/users/april/orgs","repos_url":"https://api.github.com/users/april/repos","events_url":"https://api.github.com/users/april/events{/privacy}","received_events_url":"https://api.github.com/users/april/received_events","type":"User","site_admin":false},"created_at":"2018-03-14T20:23:30Z","updated_at":"2018-03-14T20:23:30Z","author_association":"NONE","body":"You can use CSP to shut down the use of Service Workers! If you want to allow users to hoist their own JavaScript arbitrarily, then I would highly recommend hosting each create on its own domain to (mostly) sandbox them from each other. You can also do things with CSP like only allowing self-hosted resources by setting CSP to only allow from `'self'` and 'docs.rs`, which can go a long way towards mitigating problems.\r\n\r\nIf it makes your life easier, Let's Encrypt just released support for ACME v2, which allows you to get wildcard certificates for *.docs.rs."}}
{"actor":{"display_login":"april"}}