{"action":"opened","issue":{"url":"https://api.github.com/repos/calvellido/DPMbox/issues/22","labels_url":"https://api.github.com/repos/calvellido/DPMbox/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/calvellido/DPMbox/issues/22/comments","events_url":"https://api.github.com/repos/calvellido/DPMbox/issues/22/events","html_url":"https://github.com/calvellido/DPMbox/issues/22","id":108633592,"number":22,"title":"Avoid using .html() function","user":{"login":"calvellido","id":7753447,"avatar_url":"https://avatars.githubusercontent.com/u/7753447?v=3","gravatar_id":"","url":"https://api.github.com/users/calvellido","html_url":"https://github.com/calvellido","followers_url":"https://api.github.com/users/calvellido/followers","following_url":"https://api.github.com/users/calvellido/following{/other_user}","gists_url":"https://api.github.com/users/calvellido/gists{/gist_id}","starred_url":"https://api.github.com/users/calvellido/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calvellido/subscriptions","organizations_url":"https://api.github.com/users/calvellido/orgs","repos_url":"https://api.github.com/users/calvellido/repos","events_url":"https://api.github.com/users/calvellido/events{/privacy}","received_events_url":"https://api.github.com/users/calvellido/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/calvellido/DPMbox/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/calvellido/DPMbox/labels/priority","name":"priority","color":"5319e7"}],"state":"open","locked":false,"assignee":{"login":"calvellido","id":7753447,"avatar_url":"https://avatars.githubusercontent.com/u/7753447?v=3","gravatar_id":"","url":"https://api.github.com/users/calvellido","html_url":"https://github.com/calvellido","followers_url":"https://api.github.com/users/calvellido/followers","following_url":"https://api.github.com/users/calvellido/following{/other_user}","gists_url":"https://api.github.com/users/calvellido/gists{/gist_id}","starred_url":"https://api.github.com/users/calvellido/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calvellido/subscriptions","organizations_url":"https://api.github.com/users/calvellido/orgs","repos_url":"https://api.github.com/users/calvellido/repos","events_url":"https://api.github.com/users/calvellido/events{/privacy}","received_events_url":"https://api.github.com/users/calvellido/received_events","type":"User","site_admin":false},"milestone":null,"comments":0,"created_at":"2015-09-28T10:52:48Z","updated_at":"2015-09-28T10:52:48Z","closed_at":null,"body":"On the refreshSidebar() function of dpmbox-ui.js we are using the jQuery.html() function, even if this input is controlled, the use of this function is not recommended in terms of security and XSS attacks prevention.\r\n\r\nAs stated in https://vip.wordpress.com/2015/03/25/preventing-xss-in-javascript/:\r\n\r\n>This approach is dangerous, because we’re trusting that the response from any-site.com includes only safe data – something we can not guarantee, even if the site is our own. Who is to say that data.title doesn’t contain ```<script>alert( \"haxxored\");</script>;```?\r\n\r\nWe should use an alternative like passing the data through the browser’s DOM API’s, ensuring that the values are properly sanitized and remove the need to inject insecure HTML snippets into the page."}}