{"action":"created","issue":{"url":"https://api.github.com/repos/theforeman/foreman/issues/2960","labels_url":"https://api.github.com/repos/theforeman/foreman/issues/2960/labels{/name}","comments_url":"https://api.github.com/repos/theforeman/foreman/issues/2960/comments","events_url":"https://api.github.com/repos/theforeman/foreman/issues/2960/events","html_url":"https://github.com/theforeman/foreman/pull/2960","id":120377483,"number":2960,"title":"Fixes #12698 - Insufficient URL validation for Smart Proxy and Medium","user":{"login":"dLobatog","id":598891,"avatar_url":"https://avatars.githubusercontent.com/u/598891?v=3","gravatar_id":"","url":"https://api.github.com/users/dLobatog","html_url":"https://github.com/dLobatog","followers_url":"https://api.github.com/users/dLobatog/followers","following_url":"https://api.github.com/users/dLobatog/following{/other_user}","gists_url":"https://api.github.com/users/dLobatog/gists{/gist_id}","starred_url":"https://api.github.com/users/dLobatog/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dLobatog/subscriptions","organizations_url":"https://api.github.com/users/dLobatog/orgs","repos_url":"https://api.github.com/users/dLobatog/repos","events_url":"https://api.github.com/users/dLobatog/events{/privacy}","received_events_url":"https://api.github.com/users/dLobatog/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/theforeman/foreman/labels/Needs%20re-review","name":"Needs re-review","color":"0052cc"},{"url":"https://api.github.com/repos/theforeman/foreman/labels/Needs%20testing","name":"Needs testing","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-12-04T10:52:22Z","updated_at":"2015-12-10T12:53:45Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/theforeman/foreman/pulls/2960","html_url":"https://github.com/theforeman/foreman/pull/2960","diff_url":"https://github.com/theforeman/foreman/pull/2960.diff","patch_url":"https://github.com/theforeman/foreman/pull/2960.patch"},"body":"Problem: The regex that validates smart proxies URLs only matches\n'beginning of text'. This allows us to add just \\n after a valid URL and\nput anything after it. For instance, javascript:alert('hacked'). I\nhaven't found any link to the Foreman proxy URL so the script would not\ntrigger, but if we were to put link_to @smart_proxy.url somewhere (or a\n    plugin did this) it would be unsafe.\n\nSolution: Make the regex match the end of the URL with \\Z. I substituted\nthe regex by an standard one, URI.regexp so we don't have to maintain it\nanymore.\n\nExtra: I added one test for this, but other tests have been rearranged\nto use stubs rather than building actual SmartProxy objects &\nassociations."},"comment":{"url":"https://api.github.com/repos/theforeman/foreman/issues/comments/163602900","html_url":"https://github.com/theforeman/foreman/pull/2960#issuecomment-163602900","issue_url":"https://api.github.com/repos/theforeman/foreman/issues/2960","id":163602900,"user":{"login":"ohadlevy","id":20167,"avatar_url":"https://avatars.githubusercontent.com/u/20167?v=3","gravatar_id":"","url":"https://api.github.com/users/ohadlevy","html_url":"https://github.com/ohadlevy","followers_url":"https://api.github.com/users/ohadlevy/followers","following_url":"https://api.github.com/users/ohadlevy/following{/other_user}","gists_url":"https://api.github.com/users/ohadlevy/gists{/gist_id}","starred_url":"https://api.github.com/users/ohadlevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ohadlevy/subscriptions","organizations_url":"https://api.github.com/users/ohadlevy/orgs","repos_url":"https://api.github.com/users/ohadlevy/repos","events_url":"https://api.github.com/users/ohadlevy/events{/privacy}","received_events_url":"https://api.github.com/users/ohadlevy/received_events","type":"User","site_admin":false},"created_at":"2015-12-10T12:53:45Z","updated_at":"2015-12-10T12:53:45Z","body":":+1: "}}