{"action":"created","issue":{"url":"https://api.github.com/repos/yesodweb/yesod-scaffold/issues/103","labels_url":"https://api.github.com/repos/yesodweb/yesod-scaffold/issues/103/labels{/name}","comments_url":"https://api.github.com/repos/yesodweb/yesod-scaffold/issues/103/comments","events_url":"https://api.github.com/repos/yesodweb/yesod-scaffold/issues/103/events","html_url":"https://github.com/yesodweb/yesod-scaffold/issues/103","id":107765982,"number":103,"title":"XSS on new JSON example.","user":{"login":"yogsototh","id":93899,"avatar_url":"https://avatars.githubusercontent.com/u/93899?v=3","gravatar_id":"","url":"https://api.github.com/users/yogsototh","html_url":"https://github.com/yogsototh","followers_url":"https://api.github.com/users/yogsototh/followers","following_url":"https://api.github.com/users/yogsototh/following{/other_user}","gists_url":"https://api.github.com/users/yogsototh/gists{/gist_id}","starred_url":"https://api.github.com/users/yogsototh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yogsototh/subscriptions","organizations_url":"https://api.github.com/users/yogsototh/orgs","repos_url":"https://api.github.com/users/yogsototh/repos","events_url":"https://api.github.com/users/yogsototh/events{/privacy}","received_events_url":"https://api.github.com/users/yogsototh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-22T17:51:57Z","updated_at":"2015-09-22T19:17:15Z","closed_at":null,"body":"In the latest JSON support example, if you enter the following comment\r\n\r\n    <script>alert(\"Hi!!!\");</script>\r\n\r\nThe script is triggered. It might be a good idea to protect it. I just discovered this. I didn't tried to fix it for now."},"comment":{"url":"https://api.github.com/repos/yesodweb/yesod-scaffold/issues/comments/142390214","html_url":"https://github.com/yesodweb/yesod-scaffold/issues/103#issuecomment-142390214","issue_url":"https://api.github.com/repos/yesodweb/yesod-scaffold/issues/103","id":142390214,"user":{"login":"yogsototh","id":93899,"avatar_url":"https://avatars.githubusercontent.com/u/93899?v=3","gravatar_id":"","url":"https://api.github.com/users/yogsototh","html_url":"https://github.com/yogsototh","followers_url":"https://api.github.com/users/yogsototh/followers","following_url":"https://api.github.com/users/yogsototh/following{/other_user}","gists_url":"https://api.github.com/users/yogsototh/gists{/gist_id}","starred_url":"https://api.github.com/users/yogsototh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yogsototh/subscriptions","organizations_url":"https://api.github.com/users/yogsototh/orgs","repos_url":"https://api.github.com/users/yogsototh/repos","events_url":"https://api.github.com/users/yogsototh/events{/privacy}","received_events_url":"https://api.github.com/users/yogsototh/received_events","type":"User","site_admin":false},"created_at":"2015-09-22T19:17:15Z","updated_at":"2015-09-22T19:17:15Z","body":"One simple solution (but not very nice) is to add this function\r\n\r\n~~~\r\n  var  escapeHtml = function (str) {\r\n                        var div = document.createElement('div');\r\n                        div.appendChild(document.createTextNode(str));\r\n                        return div.innerHTML;\r\n                        };\r\n~~~\r\n\r\nAnd to use it later:\r\n\r\n~~~\r\n        $(\"##{rawJS commentListId}\").append(\"<li>\" + escapeHtml(data.message) + \"</li>\");\r\n~~~\r\n\r\nI would certainly prefer the protection to be enforced by the type system thought."}}