{"action":"created","issue":{"url":"https://api.github.com/repos/leancloud/js-realtime-sdk/issues/54","labels_url":"https://api.github.com/repos/leancloud/js-realtime-sdk/issues/54/labels{/name}","comments_url":"https://api.github.com/repos/leancloud/js-realtime-sdk/issues/54/comments","events_url":"https://api.github.com/repos/leancloud/js-realtime-sdk/issues/54/events","html_url":"https://github.com/leancloud/js-realtime-sdk/issues/54","id":65402058,"number":54,"title":"考虑 SDK 是否需要默认防止 XSS","user":{"login":"wangxiao","id":558368,"avatar_url":"https://avatars.githubusercontent.com/u/558368?v=3","gravatar_id":"","url":"https://api.github.com/users/wangxiao","html_url":"https://github.com/wangxiao","followers_url":"https://api.github.com/users/wangxiao/followers","following_url":"https://api.github.com/users/wangxiao/following{/other_user}","gists_url":"https://api.github.com/users/wangxiao/gists{/gist_id}","starred_url":"https://api.github.com/users/wangxiao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wangxiao/subscriptions","organizations_url":"https://api.github.com/users/wangxiao/orgs","repos_url":"https://api.github.com/users/wangxiao/repos","events_url":"https://api.github.com/users/wangxiao/events{/privacy}","received_events_url":"https://api.github.com/users/wangxiao/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-03-31T08:59:20Z","updated_at":"2015-04-07T08:42:36Z","closed_at":null,"body":"@killme2008 @sunng87 @jwfing \r\n实时聊天 SDK 使用过程中发现很多用户试了 XSS，如果是一般的小白用户可能就会忽略这个问题。\r\n所以，是否 SDK 层面直接把 XSS 过滤默认做了？\r\n如果用户有不做的需求，那我们有个配置，可以不做 XSS 转义，但是默认 SDK 层面是做 XSS 防御的。\r\n"},"comment":{"url":"https://api.github.com/repos/leancloud/js-realtime-sdk/issues/comments/90465801","html_url":"https://github.com/leancloud/js-realtime-sdk/issues/54#issuecomment-90465801","issue_url":"https://api.github.com/repos/leancloud/js-realtime-sdk/issues/54","id":90465801,"user":{"login":"zswang","id":536587,"avatar_url":"https://avatars.githubusercontent.com/u/536587?v=3","gravatar_id":"","url":"https://api.github.com/users/zswang","html_url":"https://github.com/zswang","followers_url":"https://api.github.com/users/zswang/followers","following_url":"https://api.github.com/users/zswang/following{/other_user}","gists_url":"https://api.github.com/users/zswang/gists{/gist_id}","starred_url":"https://api.github.com/users/zswang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zswang/subscriptions","organizations_url":"https://api.github.com/users/zswang/orgs","repos_url":"https://api.github.com/users/zswang/repos","events_url":"https://api.github.com/users/zswang/events{/privacy}","received_events_url":"https://api.github.com/users/zswang/received_events","type":"User","site_admin":false},"created_at":"2015-04-07T08:42:36Z","updated_at":"2015-04-07T08:42:36Z","body":"不需要吧，你怎么知道哪个 json 是用来渲染的？不做渲染的 json 你编码了。。。这不是又一个坑。"}}