{"action":"closed","issue":{"url":"https://api.github.com/repos/chocolatey/chocolatey.org/issues/270","labels_url":"https://api.github.com/repos/chocolatey/chocolatey.org/issues/270/labels{/name}","comments_url":"https://api.github.com/repos/chocolatey/chocolatey.org/issues/270/comments","events_url":"https://api.github.com/repos/chocolatey/chocolatey.org/issues/270/events","html_url":"https://github.com/chocolatey/chocolatey.org/issues/270","id":119268115,"number":270,"title":"Do not allow HTML tags in markdown conversion","user":{"login":"ferventcoder","id":63502,"avatar_url":"https://avatars.githubusercontent.com/u/63502?v=3","gravatar_id":"","url":"https://api.github.com/users/ferventcoder","html_url":"https://github.com/ferventcoder","followers_url":"https://api.github.com/users/ferventcoder/followers","following_url":"https://api.github.com/users/ferventcoder/following{/other_user}","gists_url":"https://api.github.com/users/ferventcoder/gists{/gist_id}","starred_url":"https://api.github.com/users/ferventcoder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ferventcoder/subscriptions","organizations_url":"https://api.github.com/users/ferventcoder/orgs","repos_url":"https://api.github.com/users/ferventcoder/repos","events_url":"https://api.github.com/users/ferventcoder/events{/privacy}","received_events_url":"https://api.github.com/users/ferventcoder/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chocolatey/chocolatey.org/labels/4%20-%20Released","name":"4 - Released","color":"777777"},{"url":"https://api.github.com/repos/chocolatey/chocolatey.org/labels/Bug","name":"Bug","color":"fc2929"},{"url":"https://api.github.com/repos/chocolatey/chocolatey.org/labels/Priority_HIGH","name":"Priority_HIGH","color":"e11d21"},{"url":"https://api.github.com/repos/chocolatey/chocolatey.org/labels/Security","name":"Security","color":"5319e7"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-28T03:25:50Z","updated_at":"2015-11-28T04:18:54Z","closed_at":"2015-11-28T04:18:54Z","body":"A package creator could create a malicious script to\r\ntake advantage of the markdown conversion and run arbitrary scripts\r\nwith as little as a script tag stuffed in the description or\r\nreleaseNotes fields of the nuspec.\r\n\r\nWhile the  possibility of something like this getting approved is low,\r\nthe attack vector might allow someone to gain access to another user's\r\ncookies with a carefully crafted script and be sent to unsuspecting\r\nfolks by merely passing them a package page url.\r\n\r\nTo remove the possibility of arbitrary script execution or other\r\nchances for HTML or script injection from packages, remove the ability\r\nfor the package contents to be interpreted as HTML tags and only\r\nconvert the contents to markdown after converting any \"<\" or \">\" to\r\ntheir html escaped alternatives.\r\n"}}