{"action":"created","issue":{"url":"https://api.github.com/repos/jupyter/nbviewer/issues/472","labels_url":"https://api.github.com/repos/jupyter/nbviewer/issues/472/labels{/name}","comments_url":"https://api.github.com/repos/jupyter/nbviewer/issues/472/comments","events_url":"https://api.github.com/repos/jupyter/nbviewer/issues/472/events","html_url":"https://github.com/jupyter/nbviewer/issues/472","id":90556453,"number":472,"title":"XSS in GitHub Gist file not found error message","user":{"login":"bburky","id":140526,"avatar_url":"https://avatars.githubusercontent.com/u/140526?v=3","gravatar_id":"","url":"https://api.github.com/users/bburky","html_url":"https://github.com/bburky","followers_url":"https://api.github.com/users/bburky/followers","following_url":"https://api.github.com/users/bburky/following{/other_user}","gists_url":"https://api.github.com/users/bburky/gists{/gist_id}","starred_url":"https://api.github.com/users/bburky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bburky/subscriptions","organizations_url":"https://api.github.com/users/bburky/orgs","repos_url":"https://api.github.com/users/bburky/repos","events_url":"https://api.github.com/users/bburky/events{/privacy}","received_events_url":"https://api.github.com/users/bburky/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-06-24T03:46:47Z","updated_at":"2015-07-11T14:24:07Z","closed_at":"2015-07-11T14:24:07Z","body":"The error message for files not found in a gist includes the missing filename to be included in the 404 response. This filename is unsanitized for HTML and enables an XSS. \r\n\r\nChrome's XSS auditor will hide this simple XSS, look in the devtools console to see the error.\r\n\r\nhttp://nbviewer.ipython.org/gist/bburky/7763555/%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%3E\r\n\r\nSee also #471"},"comment":{"url":"https://api.github.com/repos/jupyter/nbviewer/issues/comments/120625675","html_url":"https://github.com/jupyter/nbviewer/issues/472#issuecomment-120625675","issue_url":"https://api.github.com/repos/jupyter/nbviewer/issues/472","id":120625675,"user":{"login":"bollwyvl","id":45380,"avatar_url":"https://avatars.githubusercontent.com/u/45380?v=3","gravatar_id":"","url":"https://api.github.com/users/bollwyvl","html_url":"https://github.com/bollwyvl","followers_url":"https://api.github.com/users/bollwyvl/followers","following_url":"https://api.github.com/users/bollwyvl/following{/other_user}","gists_url":"https://api.github.com/users/bollwyvl/gists{/gist_id}","starred_url":"https://api.github.com/users/bollwyvl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bollwyvl/subscriptions","organizations_url":"https://api.github.com/users/bollwyvl/orgs","repos_url":"https://api.github.com/users/bollwyvl/repos","events_url":"https://api.github.com/users/bollwyvl/events{/privacy}","received_events_url":"https://api.github.com/users/bollwyvl/received_events","type":"User","site_admin":false},"created_at":"2015-07-11T14:24:07Z","updated_at":"2015-07-11T14:24:07Z","body":"Fix deployed!"}}