{"action":"created","issue":{"url":"https://api.github.com/repos/ipython/ipython/issues/7493","labels_url":"https://api.github.com/repos/ipython/ipython/issues/7493/labels{/name}","comments_url":"https://api.github.com/repos/ipython/ipython/issues/7493/comments","events_url":"https://api.github.com/repos/ipython/ipython/issues/7493/events","html_url":"https://github.com/ipython/ipython/pull/7493","id":54665454,"number":7493,"title":"Sanitize dialog text-body.","user":{"login":"Carreau","id":335567,"avatar_url":"https://avatars.githubusercontent.com/u/335567?v=3","gravatar_id":"","url":"https://api.github.com/users/Carreau","html_url":"https://github.com/Carreau","followers_url":"https://api.github.com/users/Carreau/followers","following_url":"https://api.github.com/users/Carreau/following{/other_user}","gists_url":"https://api.github.com/users/Carreau/gists{/gist_id}","starred_url":"https://api.github.com/users/Carreau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Carreau/subscriptions","organizations_url":"https://api.github.com/users/Carreau/orgs","repos_url":"https://api.github.com/users/Carreau/repos","events_url":"https://api.github.com/users/Carreau/events{/privacy}","received_events_url":"https://api.github.com/users/Carreau/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ipython/ipython/labels/waiting-for-author","name":"waiting-for-author","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-01-17T15:54:37Z","updated_at":"2015-01-19T21:11:38Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/ipython/ipython/pulls/7493","html_url":"https://github.com/ipython/ipython/pull/7493","diff_url":"https://github.com/ipython/ipython/pull/7493.diff","patch_url":"https://github.com/ipython/ipython/pull/7493.patch"},"body":"Mitigate 7486, could probably be improved, but\r\ntreat text as pure text, but assume that when received a dom\r\nelement it actually come from a secure source.\r\n\r\nSanitizing all we get, including Dom Element break json-metadata editor\r\nand a few others."},"comment":{"url":"https://api.github.com/repos/ipython/ipython/issues/comments/70561508","html_url":"https://github.com/ipython/ipython/pull/7493#issuecomment-70561508","issue_url":"https://api.github.com/repos/ipython/ipython/issues/7493","id":70561508,"user":{"login":"jdfreder","id":3292874,"avatar_url":"https://avatars.githubusercontent.com/u/3292874?v=3","gravatar_id":"","url":"https://api.github.com/users/jdfreder","html_url":"https://github.com/jdfreder","followers_url":"https://api.github.com/users/jdfreder/followers","following_url":"https://api.github.com/users/jdfreder/following{/other_user}","gists_url":"https://api.github.com/users/jdfreder/gists{/gist_id}","starred_url":"https://api.github.com/users/jdfreder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdfreder/subscriptions","organizations_url":"https://api.github.com/users/jdfreder/orgs","repos_url":"https://api.github.com/users/jdfreder/repos","events_url":"https://api.github.com/users/jdfreder/events{/privacy}","received_events_url":"https://api.github.com/users/jdfreder/received_events","type":"User","site_admin":false},"created_at":"2015-01-19T21:11:38Z","updated_at":"2015-01-19T21:11:38Z","body":"> The problem is that in some places, I had the dialog sow error/response message from server, which is a potential security flaw to inject js. It is better to sanitize by default everywhere and be explicit when you want safety off than the other way around.\r\n\r\nI disagree with this.  This dialog method should be treated like a `.html` method.  The error messages should be sanitized before being passed to the dialog method.\r\n\r\nAlternatively, you could create a convenience flag on this method, i.e. `sanitize: true` which triggered sanitation to happen.  I think that would be better than having sanitation triggered implicitly by argument type."}}