{"action":"closed","issue":{"url":"https://api.github.com/repos/angular/material/issues/2901","labels_url":"https://api.github.com/repos/angular/material/issues/2901/labels{/name}","comments_url":"https://api.github.com/repos/angular/material/issues/2901/comments","events_url":"https://api.github.com/repos/angular/material/issues/2901/events","html_url":"https://github.com/angular/material/issues/2901","id":78062431,"number":2901,"title":"mdAutocomplete: XSS vulnerability","user":{"login":"chr22","id":3649594,"avatar_url":"https://avatars.githubusercontent.com/u/3649594?v=3","gravatar_id":"","url":"https://api.github.com/users/chr22","html_url":"https://github.com/chr22","followers_url":"https://api.github.com/users/chr22/followers","following_url":"https://api.github.com/users/chr22/following{/other_user}","gists_url":"https://api.github.com/users/chr22/gists{/gist_id}","starred_url":"https://api.github.com/users/chr22/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chr22/subscriptions","organizations_url":"https://api.github.com/users/chr22/orgs","repos_url":"https://api.github.com/users/chr22/repos","events_url":"https://api.github.com/users/chr22/events{/privacy}","received_events_url":"https://api.github.com/users/chr22/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"robertmesserle","id":571363,"avatar_url":"https://avatars.githubusercontent.com/u/571363?v=3","gravatar_id":"","url":"https://api.github.com/users/robertmesserle","html_url":"https://github.com/robertmesserle","followers_url":"https://api.github.com/users/robertmesserle/followers","following_url":"https://api.github.com/users/robertmesserle/following{/other_user}","gists_url":"https://api.github.com/users/robertmesserle/gists{/gist_id}","starred_url":"https://api.github.com/users/robertmesserle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robertmesserle/subscriptions","organizations_url":"https://api.github.com/users/robertmesserle/orgs","repos_url":"https://api.github.com/users/robertmesserle/repos","events_url":"https://api.github.com/users/robertmesserle/events{/privacy}","received_events_url":"https://api.github.com/users/robertmesserle/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/angular/material/milestones/15","html_url":"https://github.com/angular/material/milestones/0.10.0","labels_url":"https://api.github.com/repos/angular/material/milestones/15/labels","id":958568,"number":15,"title":"0.10.0","description":"### Component Features\r\n\r\n- DateTimepicker\r\n- SpeedDial\r\n- Menu\r\n- Chips (cont.)\r\n- Slider range\r\n- textfields\r\n  *  `<md-text-search>`\r\n- bi-directional support (cont.)\r\n\r\n### Additional Efforts\r\n\r\nProvide 'Edit on CodePen'\r\nProvide Version Picker and Documentation locking to specific builds/releases\r\nBuild tool to supports selection of icons and svgs to bundle.\r\n\r\n\r\n","creator":{"login":"ThomasBurleson","id":210413,"avatar_url":"https://avatars.githubusercontent.com/u/210413?v=3","gravatar_id":"","url":"https://api.github.com/users/ThomasBurleson","html_url":"https://github.com/ThomasBurleson","followers_url":"https://api.github.com/users/ThomasBurleson/followers","following_url":"https://api.github.com/users/ThomasBurleson/following{/other_user}","gists_url":"https://api.github.com/users/ThomasBurleson/gists{/gist_id}","starred_url":"https://api.github.com/users/ThomasBurleson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThomasBurleson/subscriptions","organizations_url":"https://api.github.com/users/ThomasBurleson/orgs","repos_url":"https://api.github.com/users/ThomasBurleson/repos","events_url":"https://api.github.com/users/ThomasBurleson/events{/privacy}","received_events_url":"https://api.github.com/users/ThomasBurleson/received_events","type":"User","site_admin":false},"open_issues":377,"closed_issues":101,"state":"open","created_at":"2015-01-30T17:00:57Z","updated_at":"2015-05-20T02:16:03Z","due_on":"2015-05-26T05:00:00Z","closed_at":null},"comments":3,"created_at":"2015-05-19T12:13:20Z","updated_at":"2015-05-20T02:16:03Z","closed_at":"2015-05-20T02:16:03Z","body":"You generate HTML from a string to highlight the matching part of the search string in the result.\r\n\r\nhttps://github.com/angular/material/blob/master/src/components/autocomplete/js/highlightController.js#L11\r\n\r\nIf the search result is this as a string:\r\n![capture](https://cloud.githubusercontent.com/assets/3649594/7702593/a2286488-fe31-11e4-8250-d93cd098b193.JPG)\r\n\r\n\r\nand you search for \"x\" then the resulting output is this, with a real script-tag that gets executed:\r\n![capture1](https://cloud.githubusercontent.com/assets/3649594/7702571/7a7e69dc-fe31-11e4-855f-130920a983a9.JPG)\r\n\r\nI cant create a CodePen because it won't let me insert a script tag in a javascript string.\r\n\r\nI can see that you have some sort of sanitizing with a RegEx, that i cant decipher."}}