{"action":"created","issue":{"url":"https://api.github.com/repos/shakacode/react_on_rails/issues/47","labels_url":"https://api.github.com/repos/shakacode/react_on_rails/issues/47/labels{/name}","comments_url":"https://api.github.com/repos/shakacode/react_on_rails/issues/47/comments","events_url":"https://api.github.com/repos/shakacode/react_on_rails/issues/47/events","html_url":"https://github.com/shakacode/react_on_rails/issues/47","id":109095666,"number":47,"title":"XSS vulnerability: serialization of props, exposed on the client","user":{"login":"alexfedoseev","id":4244251,"avatar_url":"https://avatars.githubusercontent.com/u/4244251?v=3","gravatar_id":"","url":"https://api.github.com/users/alexfedoseev","html_url":"https://github.com/alexfedoseev","followers_url":"https://api.github.com/users/alexfedoseev/followers","following_url":"https://api.github.com/users/alexfedoseev/following{/other_user}","gists_url":"https://api.github.com/users/alexfedoseev/gists{/gist_id}","starred_url":"https://api.github.com/users/alexfedoseev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexfedoseev/subscriptions","organizations_url":"https://api.github.com/users/alexfedoseev/orgs","repos_url":"https://api.github.com/users/alexfedoseev/repos","events_url":"https://api.github.com/users/alexfedoseev/events{/privacy}","received_events_url":"https://api.github.com/users/alexfedoseev/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/shakacode/react_on_rails/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/shakacode/react_on_rails/milestones/1","html_url":"https://github.com/shakacode/react_on_rails/milestones/1.0","labels_url":"https://api.github.com/repos/shakacode/react_on_rails/milestones/1/labels","id":1280643,"number":1,"title":"1.0","description":null,"creator":{"login":"justin808","id":1118459,"avatar_url":"https://avatars.githubusercontent.com/u/1118459?v=3","gravatar_id":"","url":"https://api.github.com/users/justin808","html_url":"https://github.com/justin808","followers_url":"https://api.github.com/users/justin808/followers","following_url":"https://api.github.com/users/justin808/following{/other_user}","gists_url":"https://api.github.com/users/justin808/gists{/gist_id}","starred_url":"https://api.github.com/users/justin808/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justin808/subscriptions","organizations_url":"https://api.github.com/users/justin808/orgs","repos_url":"https://api.github.com/users/justin808/repos","events_url":"https://api.github.com/users/justin808/events{/privacy}","received_events_url":"https://api.github.com/users/justin808/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":7,"state":"open","created_at":"2015-08-30T20:52:43Z","updated_at":"2015-10-02T17:57:22Z","due_on":null,"closed_at":null},"comments":7,"created_at":"2015-09-30T13:56:52Z","updated_at":"2015-10-05T05:36:07Z","closed_at":null,"body":"As we discussed a few days ago, there is an issue with serialization of props, exposed on the client. Since these props may contain user's input and they will be exposed as javascript variable in the browser, we must escape it to prevent harmful script injection.\r\n\r\nHere is the lib that I'm using in Node environment to serialize javascript before it will be exposed on the client: https://github.com/yahoo/serialize-javascript/\r\n\r\nWe should implement escaping of JS the same way, but on the Ruby side.\r\n\r\n/cc: @justin808 @samnang "},"comment":{"url":"https://api.github.com/repos/shakacode/react_on_rails/issues/comments/145435170","html_url":"https://github.com/shakacode/react_on_rails/issues/47#issuecomment-145435170","issue_url":"https://api.github.com/repos/shakacode/react_on_rails/issues/47","id":145435170,"user":{"login":"justin808","id":1118459,"avatar_url":"https://avatars.githubusercontent.com/u/1118459?v=3","gravatar_id":"","url":"https://api.github.com/users/justin808","html_url":"https://github.com/justin808","followers_url":"https://api.github.com/users/justin808/followers","following_url":"https://api.github.com/users/justin808/following{/other_user}","gists_url":"https://api.github.com/users/justin808/gists{/gist_id}","starred_url":"https://api.github.com/users/justin808/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justin808/subscriptions","organizations_url":"https://api.github.com/users/justin808/orgs","repos_url":"https://api.github.com/users/justin808/repos","events_url":"https://api.github.com/users/justin808/events{/privacy}","received_events_url":"https://api.github.com/users/justin808/received_events","type":"User","site_admin":false},"created_at":"2015-10-05T05:36:07Z","updated_at":"2015-10-05T05:36:07Z","body":"Example of safe and non-safe json conversion\r\n\r\n```ruby\r\n[24] (pry) main: 0> aa\r\n{\r\n        :hello => \"world\",\r\n         :free => \"of charge\",\r\n      \"script\" => \"<script>alert(\\\"yo\\\");</script>\",\r\n    \"<script>\" => \"<script>alert(\\\"yo\\\");</script>\"\r\n}\r\n[25] (pry) main: 0> non_safe = JSON.generate(aa)\r\n\"{\\\"hello\\\":\\\"world\\\",\\\"free\\\":\\\"of charge\\\",\\\"script\\\":\\\"<script>alert(\\\\\\\"yo\\\\\\\");</script>\\\",\\\"<script>\\\":\\\"<script>alert(\\\\\\\"yo\\\\\\\");</script>\\\"}\"\r\n\r\n[27] (pry) main: 0> safe = aa.to_json\r\n\"{\\\"hello\\\":\\\"world\\\",\\\"free\\\":\\\"of charge\\\",\\\"script\\\":\\\"\\\\u003cscript\\\\u003ealert(\\\\\\\"yo\\\\\\\");\\\\u003c/script\\\\u003e\\\",\\\"\\\\u003cscript\\\\u003e\\\":\\\"\\\\u003cscript\\\\u003ealert(\\\\\\\"yo\\\\\\\");\\\\u003c/script\\\\u003e\\\"}\"\r\n```"}}