{"action":"created","issue":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/8622","labels_url":"https://api.github.com/repos/yiisoft/yii2/issues/8622/labels{/name}","comments_url":"https://api.github.com/repos/yiisoft/yii2/issues/8622/comments","events_url":"https://api.github.com/repos/yiisoft/yii2/issues/8622/events","html_url":"https://github.com/yiisoft/yii2/issues/8622","id":83419501,"number":8622,"title":"Apps and extensions that use Json::encode are still vulnerable to CVE-2015-3397","user":{"login":"nkovacs","id":2269242,"avatar_url":"https://avatars.githubusercontent.com/u/2269242?v=3","gravatar_id":"","url":"https://api.github.com/users/nkovacs","html_url":"https://github.com/nkovacs","followers_url":"https://api.github.com/users/nkovacs/followers","following_url":"https://api.github.com/users/nkovacs/following{/other_user}","gists_url":"https://api.github.com/users/nkovacs/gists{/gist_id}","starred_url":"https://api.github.com/users/nkovacs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nkovacs/subscriptions","organizations_url":"https://api.github.com/users/nkovacs/orgs","repos_url":"https://api.github.com/users/nkovacs/repos","events_url":"https://api.github.com/users/nkovacs/events{/privacy}","received_events_url":"https://api.github.com/users/nkovacs/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/yiisoft/yii2/labels/type:docs","name":"type:docs","color":"207de5"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-01T10:10:38Z","updated_at":"2015-06-01T15:02:50Z","closed_at":"2015-06-01T15:02:50Z","body":"So CVE-2015-3397 was [fixed](https://github.com/yiisoft/yii2/commit/78d3a856d3b2691a6071d23acd0f75cafe3808e0) in Yii 2, but what about extensions and applications that use `Json::encode` to pass options to a javascript snippet? They'll all have to be updated to use `Json::htmlEncode` too. Just upgrading to Yii 2.0.4 won't fix your code.\r\nThe changelog doesn't contain a lot of information about this, and I couldn't find any info on CVE-2015-3397, why it happens in IE and doesn't happen in other browsers. The [news item on the website](http://www.yiiframework.com/news/86/yii-2-0-4-is-released/) implies that just upgrading to Yii 2.0.4 is enough to fix the vulnerability in your app, but this is not true if you used `Json::encode` or an extension that uses `Json::encode`."},"comment":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/comments/107558738","html_url":"https://github.com/yiisoft/yii2/issues/8622#issuecomment-107558738","issue_url":"https://api.github.com/repos/yiisoft/yii2/issues/8622","id":107558738,"user":{"login":"cebe","id":189796,"avatar_url":"https://avatars.githubusercontent.com/u/189796?v=3","gravatar_id":"","url":"https://api.github.com/users/cebe","html_url":"https://github.com/cebe","followers_url":"https://api.github.com/users/cebe/followers","following_url":"https://api.github.com/users/cebe/following{/other_user}","gists_url":"https://api.github.com/users/cebe/gists{/gist_id}","starred_url":"https://api.github.com/users/cebe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cebe/subscriptions","organizations_url":"https://api.github.com/users/cebe/orgs","repos_url":"https://api.github.com/users/cebe/repos","events_url":"https://api.github.com/users/cebe/events{/privacy}","received_events_url":"https://api.github.com/users/cebe/received_events","type":"User","site_admin":false},"created_at":"2015-06-01T15:02:50Z","updated_at":"2015-06-01T15:02:50Z","body":"done. http://www.yiiframework.com/news/86/yii-2-0-4-is-released/"}}