{"action":"created","issue":{"url":"https://api.github.com/repos/shaarli/Shaarli/issues/119","labels_url":"https://api.github.com/repos/shaarli/Shaarli/issues/119/labels{/name}","comments_url":"https://api.github.com/repos/shaarli/Shaarli/issues/119/comments","events_url":"https://api.github.com/repos/shaarli/Shaarli/issues/119/events","html_url":"https://github.com/shaarli/Shaarli/pull/119","id":58408243,"number":119,"title":"Fixes shaarli/Shaarli#46: allow 'javascript:' links sharing","user":{"login":"ArthurHoaro","id":1962678,"avatar_url":"https://avatars.githubusercontent.com/u/1962678?v=3","gravatar_id":"","url":"https://api.github.com/users/ArthurHoaro","html_url":"https://github.com/ArthurHoaro","followers_url":"https://api.github.com/users/ArthurHoaro/followers","following_url":"https://api.github.com/users/ArthurHoaro/following{/other_user}","gists_url":"https://api.github.com/users/ArthurHoaro/gists{/gist_id}","starred_url":"https://api.github.com/users/ArthurHoaro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ArthurHoaro/subscriptions","organizations_url":"https://api.github.com/users/ArthurHoaro/orgs","repos_url":"https://api.github.com/users/ArthurHoaro/repos","events_url":"https://api.github.com/users/ArthurHoaro/events{/privacy}","received_events_url":"https://api.github.com/users/ArthurHoaro/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/shaarli/Shaarli/labels/decision%20needed","name":"decision needed","color":"fef2c0"},{"url":"https://api.github.com/repos/shaarli/Shaarli/labels/please%20test","name":"please test","color":"bfe5bf"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-02-20T20:47:34Z","updated_at":"2015-02-25T11:49:13Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/shaarli/Shaarli/pulls/119","html_url":"https://github.com/shaarli/Shaarli/pull/119","diff_url":"https://github.com/shaarli/Shaarli/pull/119.diff","patch_url":"https://github.com/shaarli/Shaarli/pull/119.patch"},"body":"Because it's easy, and it's working.\r\n\r\nEDIT: also, it's in 0.9 milestone."},"comment":{"url":"https://api.github.com/repos/shaarli/Shaarli/issues/comments/75947564","html_url":"https://github.com/shaarli/Shaarli/pull/119#issuecomment-75947564","issue_url":"https://api.github.com/repos/shaarli/Shaarli/issues/119","id":75947564,"user":{"login":"nodiscc","id":3950390,"avatar_url":"https://avatars.githubusercontent.com/u/3950390?v=3","gravatar_id":"","url":"https://api.github.com/users/nodiscc","html_url":"https://github.com/nodiscc","followers_url":"https://api.github.com/users/nodiscc/followers","following_url":"https://api.github.com/users/nodiscc/following{/other_user}","gists_url":"https://api.github.com/users/nodiscc/gists{/gist_id}","starred_url":"https://api.github.com/users/nodiscc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodiscc/subscriptions","organizations_url":"https://api.github.com/users/nodiscc/orgs","repos_url":"https://api.github.com/users/nodiscc/repos","events_url":"https://api.github.com/users/nodiscc/events{/privacy}","received_events_url":"https://api.github.com/users/nodiscc/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T11:49:13Z","updated_at":"2015-02-25T11:49:13Z","body":"No hurry :) Of course this can wait until we find an agreement. While we can add a warning dialog when visitors click on the link from Shaarli, we can't warn them when they drag the bookmarklet to their browser toolbar (where the real risk lies, as described in the article) because there's no way to detect that event from Shaarli. It can be argued that when the JS link is on the Shaarli page, it is _not a bookmarklet_ but a mere link with few/no security implications.\r\n\r\n_OT: actually IE did the right thing. Sad to see that Mozilla didn't bother to implement such a safeguard against malicious bookmarklets. Instead they chose to [completely block bookmarklets](https://bugzilla.mozilla.org/show_bug.cgi?id=866522) with no workaround when the site's CSP forbids them._\r\n\r\nI'd like to have other opinions too."}}