{"action":"created","issue":{"url":"https://api.github.com/repos/johndyer/mediaelement/issues/1390","labels_url":"https://api.github.com/repos/johndyer/mediaelement/issues/1390/labels{/name}","comments_url":"https://api.github.com/repos/johndyer/mediaelement/issues/1390/comments","events_url":"https://api.github.com/repos/johndyer/mediaelement/issues/1390/events","html_url":"https://github.com/johndyer/mediaelement/pull/1390","id":52284202,"number":1390,"title":"OWASP -  alowscriptaccess to  sameDomain","user":{"login":"gregoryo","id":6955,"avatar_url":"https://avatars.githubusercontent.com/u/6955?v=3","gravatar_id":"","url":"https://api.github.com/users/gregoryo","html_url":"https://github.com/gregoryo","followers_url":"https://api.github.com/users/gregoryo/followers","following_url":"https://api.github.com/users/gregoryo/following{/other_user}","gists_url":"https://api.github.com/users/gregoryo/gists{/gist_id}","starred_url":"https://api.github.com/users/gregoryo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gregoryo/subscriptions","organizations_url":"https://api.github.com/users/gregoryo/orgs","repos_url":"https://api.github.com/users/gregoryo/repos","events_url":"https://api.github.com/users/gregoryo/events{/privacy}","received_events_url":"https://api.github.com/users/gregoryo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2014-12-17T19:59:21Z","updated_at":"2015-06-22T13:34:00Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/johndyer/mediaelement/pulls/1390","html_url":"https://github.com/johndyer/mediaelement/pull/1390","diff_url":"https://github.com/johndyer/mediaelement/pull/1390.diff","patch_url":"https://github.com/johndyer/mediaelement/pull/1390.patch"},"body":"mediaelement.js is triggering 2 OWASP security alerts.\r\n1. is for the use of AllowScriptAccess always and can be addressed with this pull.\r\n2. is described as \"This SWF constains DEBUG and DEBUGFILE opcodes which reveals the local directory structure of the machine used to create the Flash application as well as line numbers. An attacker can then potentially leverage this information to exploit the application.\"\r\n\r\ni will submit a second pull removing the debug information from display.\r\n\r\nnot sure if either of these changes will work with your current system of demo code and videos being loaded cross domain."},"comment":{"url":"https://api.github.com/repos/johndyer/mediaelement/issues/comments/114103530","html_url":"https://github.com/johndyer/mediaelement/pull/1390#issuecomment-114103530","issue_url":"https://api.github.com/repos/johndyer/mediaelement/issues/1390","id":114103530,"user":{"login":"jrglasgow","id":1824713,"avatar_url":"https://avatars.githubusercontent.com/u/1824713?v=3","gravatar_id":"","url":"https://api.github.com/users/jrglasgow","html_url":"https://github.com/jrglasgow","followers_url":"https://api.github.com/users/jrglasgow/followers","following_url":"https://api.github.com/users/jrglasgow/following{/other_user}","gists_url":"https://api.github.com/users/jrglasgow/gists{/gist_id}","starred_url":"https://api.github.com/users/jrglasgow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jrglasgow/subscriptions","organizations_url":"https://api.github.com/users/jrglasgow/orgs","repos_url":"https://api.github.com/users/jrglasgow/repos","events_url":"https://api.github.com/users/jrglasgow/events{/privacy}","received_events_url":"https://api.github.com/users/jrglasgow/received_events","type":"User","site_admin":false},"created_at":"2015-06-22T13:34:00Z","updated_at":"2015-06-22T13:34:00Z","body":"Could we set the allowScriptAccess to sameDomain as a default and add a parameter when calling MediaElement to set allowScriptAccess to always?"}}