{"action":"created","issue":{"url":"https://api.github.com/repos/erusev/parsedown/issues/495","repository_url":"https://api.github.com/repos/erusev/parsedown","labels_url":"https://api.github.com/repos/erusev/parsedown/issues/495/labels{/name}","comments_url":"https://api.github.com/repos/erusev/parsedown/issues/495/comments","events_url":"https://api.github.com/repos/erusev/parsedown/issues/495/events","html_url":"https://github.com/erusev/parsedown/pull/495","id":225375951,"number":495,"title":"Prevent various XSS attacks [rebase and update of #276]","user":{"login":"aidantwoods","id":3288888,"avatar_url":"https://avatars1.githubusercontent.com/u/3288888?v=4","gravatar_id":"","url":"https://api.github.com/users/aidantwoods","html_url":"https://github.com/aidantwoods","followers_url":"https://api.github.com/users/aidantwoods/followers","following_url":"https://api.github.com/users/aidantwoods/following{/other_user}","gists_url":"https://api.github.com/users/aidantwoods/gists{/gist_id}","starred_url":"https://api.github.com/users/aidantwoods/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aidantwoods/subscriptions","organizations_url":"https://api.github.com/users/aidantwoods/orgs","repos_url":"https://api.github.com/users/aidantwoods/repos","events_url":"https://api.github.com/users/aidantwoods/events{/privacy}","received_events_url":"https://api.github.com/users/aidantwoods/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":47,"created_at":"2017-05-01T02:47:24Z","updated_at":"2018-02-26T16:13:58Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/erusev/parsedown/pulls/495","html_url":"https://github.com/erusev/parsedown/pull/495","diff_url":"https://github.com/erusev/parsedown/pull/495.diff","patch_url":"https://github.com/erusev/parsedown/pull/495.patch"},"body":"I've picked up on the work started over at https://github.com/erusev/parsedown/pull/276 and rebased on `erusev/master`.\r\n\r\nSince this is rebased on master, I can't point at PR at `naNuke/master` without running into the merge conflicts that I've already resolved manually.\r\n\r\nI've implemented what I suggested [earlier](https://github.com/erusev/parsedown/pull/276#issuecomment-298244798) so that all attributes are properly encoded (and not just the specific ones we remember).\r\n\r\nI've also added some tests, so @erusev's concern here should hopefully now be resolved, albeit a year later 😉 \r\nhttps://github.com/erusev/parsedown/pull/276#issuecomment-178577968\r\n> @malas one reason is the lack of tests\r\n\r\n~~One thing to note is that all this can be circumvented if you forget to turn on `$Parsedown->setMarkupEscaped(true);`\r\n(which is off by default) as you could just write a script tag manually for xss (even though the attributes and link destinations will be safe). So let's all remember to enable this setting 😉~~\r\n\r\nAttributes are now always escaped properly (this speaks to just outputting things correctly), but link based XSS or XSS from writing plain old script tags will only be prevented only if the new `setSafeMode` is enabled.\r\n\r\n```php\r\n$Parsedown->setSafeMode(true);\r\n```\r\n\r\n---\r\n\r\nCloses #161\r\nCloses #497\r\nCloses #276\r\nCloses #403 \r\nCloses #530"},"comment":{"url":"https://api.github.com/repos/erusev/parsedown/issues/comments/368555723","html_url":"https://github.com/erusev/parsedown/pull/495#issuecomment-368555723","issue_url":"https://api.github.com/repos/erusev/parsedown/issues/495","id":368555723,"user":{"login":"aidantwoods","id":3288888,"avatar_url":"https://avatars1.githubusercontent.com/u/3288888?v=4","gravatar_id":"","url":"https://api.github.com/users/aidantwoods","html_url":"https://github.com/aidantwoods","followers_url":"https://api.github.com/users/aidantwoods/followers","following_url":"https://api.github.com/users/aidantwoods/following{/other_user}","gists_url":"https://api.github.com/users/aidantwoods/gists{/gist_id}","starred_url":"https://api.github.com/users/aidantwoods/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aidantwoods/subscriptions","organizations_url":"https://api.github.com/users/aidantwoods/orgs","repos_url":"https://api.github.com/users/aidantwoods/repos","events_url":"https://api.github.com/users/aidantwoods/events{/privacy}","received_events_url":"https://api.github.com/users/aidantwoods/received_events","type":"User","site_admin":false},"created_at":"2018-02-26T16:13:58Z","updated_at":"2018-02-26T16:13:58Z","author_association":"CONTRIBUTOR","body":"@erusev You've made Parsedown available for free, and of course you're under no obligation to maintain the codebase on the behalf of those that choose to use it. However, there also is a large community which has chosen to depend on Parsedown. Unfortunately people cannot reasonably depend on software that receives no maintenance, and seems pretty clear to me that the way things are currently going, Parsedown therefore can't sustain the community that depends on it.\r\n\r\nThere seems to be an ongoing theme that, because you care about Parsedown, you want to carefully examine every line of code that goes into it. Unfortunately you also appear to be in a situation such that you cannot dedicate enough time into reviewing/writing code for Parsedown that would allow others to depend on it.\r\n\r\nFrom my point of view there are two solutions to this that keep the community here:\r\n1. You somehow find more time to support the community; or\r\n2. You allow others to help out (this would mean permitting others to review, merge, and release code, as well as being able to manage issues – essentially some new admins on the repo).\r\n\r\nFailing this I feel that Parsedown's community will look elsewhere, or worse: be left relying on stagnant code. Unfortunately I cannot personally recommend that anyone even use Parsedown currently: when security issues are left idle for so long it becomes dangerous to use software, especially if something worse than this were to come along – no one could be confident it would be fixed with any urgency. I would love to be able to recommend Parsedown if things change though.\r\n\r\nI think the only other real solution failing the above two options is for some community members to proceed with new development on a fork.\r\n\r\n@tillkruss \r\n> Replacing Parsedown as a dependency seems like a lot of effort. I'd rather see a forked repo that is maintained by the community.\r\n\r\nWherever new development ends up (including the possibility of it staying in this repo), #553 might be a good start for anyone willing to help.\r\n\r\n"}}
{"actor":{"display_login":"aidantwoods"}}