{"action":"opened","number":13453,"pull_request":{"url":"https://api.github.com/repos/angular/angular.js/pulls/13453","id":52761503,"html_url":"https://github.com/angular/angular.js/pull/13453","diff_url":"https://github.com/angular/angular.js/pull/13453.diff","patch_url":"https://github.com/angular/angular.js/pull/13453.patch","issue_url":"https://api.github.com/repos/angular/angular.js/issues/13453","number":13453,"state":"open","locked":false,"title":"fix($sanitize): blacklist SVG `<use>` elements","user":{"login":"petebacondarwin","id":15655,"avatar_url":"https://avatars.githubusercontent.com/u/15655?v=3","gravatar_id":"","url":"https://api.github.com/users/petebacondarwin","html_url":"https://github.com/petebacondarwin","followers_url":"https://api.github.com/users/petebacondarwin/followers","following_url":"https://api.github.com/users/petebacondarwin/following{/other_user}","gists_url":"https://api.github.com/users/petebacondarwin/gists{/gist_id}","starred_url":"https://api.github.com/users/petebacondarwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petebacondarwin/subscriptions","organizations_url":"https://api.github.com/users/petebacondarwin/orgs","repos_url":"https://api.github.com/users/petebacondarwin/repos","events_url":"https://api.github.com/users/petebacondarwin/events{/privacy}","received_events_url":"https://api.github.com/users/petebacondarwin/received_events","type":"User","site_admin":false},"body":"The use element can reference external svg's (same origin) and can include\r\nxlink javascript urls or foreign object that can execute xss.\r\n\r\nThis change disallows `<use>` elements in sanitized SVG markup.\r\n\r\nAn example of a malicious SVG document would be:\r\n\r\nSVG to sanitize:\r\n```\r\n<svg><use xlink:href=\"test.svg#xss\" /></svg>\r\n```\r\n\r\nExternal SVG file (test.svg)\r\n```\r\n<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\r\n<svg xmlns:svg=\"http://www.w3.org/2000/svg\"\r\n   xmlns=\"http://www.w3.org/2000/svg\" width=\"100\"\r\n   height=\"100\"\r\n   id=\"xss\">\r\n<a xmlns:xlink=\"http://www.w3.org/1999/xlink\" xlink:href=\"javascript:alert(1)\">\r\n  <circle cx=\"50\" cy=\"50\" r=\"40\" stroke=\"black\" stroke-width=\"3\" fill=\"red\" />\r\n</a>\r\n</svg>\r\n```\r\n\r\nHere the SVG to sanitize loads in the `test.svg` file via the `<use>` element.\r\nThe sanitizer is not able to parse this file, which contains malicious\r\nexecutable mark-up.\r\n\r\nThis can only be taken advantage of if the external file is available via the\r\nsame origin restrictions in place.","created_at":"2015-12-05T18:50:16Z","updated_at":"2015-12-05T18:50:16Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":{"login":"petebacondarwin","id":15655,"avatar_url":"https://avatars.githubusercontent.com/u/15655?v=3","gravatar_id":"","url":"https://api.github.com/users/petebacondarwin","html_url":"https://github.com/petebacondarwin","followers_url":"https://api.github.com/users/petebacondarwin/followers","following_url":"https://api.github.com/users/petebacondarwin/following{/other_user}","gists_url":"https://api.github.com/users/petebacondarwin/gists{/gist_id}","starred_url":"https://api.github.com/users/petebacondarwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petebacondarwin/subscriptions","organizations_url":"https://api.github.com/users/petebacondarwin/orgs","repos_url":"https://api.github.com/users/petebacondarwin/repos","events_url":"https://api.github.com/users/petebacondarwin/events{/privacy}","received_events_url":"https://api.github.com/users/petebacondarwin/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/angular/angular.js/milestones/111","html_url":"https://github.com/angular/angular.js/milestones/1.5.0-rc.0","labels_url":"https://api.github.com/repos/angular/angular.js/milestones/111/labels","id":1431120,"number":111,"title":"1.5.0-rc.0","description":"","creator":{"login":"Narretz","id":1153097,"avatar_url":"https://avatars.githubusercontent.com/u/1153097?v=3","gravatar_id":"","url":"https://api.github.com/users/Narretz","html_url":"https://github.com/Narretz","followers_url":"https://api.github.com/users/Narretz/followers","following_url":"https://api.github.com/users/Narretz/following{/other_user}","gists_url":"https://api.github.com/users/Narretz/gists{/gist_id}","starred_url":"https://api.github.com/users/Narretz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Narretz/subscriptions","organizations_url":"https://api.github.com/users/Narretz/orgs","repos_url":"https://api.github.com/users/Narretz/repos","events_url":"https://api.github.com/users/Narretz/events{/privacy}","received_events_url":"https://api.github.com/users/Narretz/received_events","type":"User","site_admin":false},"open_issues":6,"closed_issues":9,"state":"open","created_at":"2015-11-26T12:59:26Z","updated_at":"2015-12-05T18:50:16Z","due_on":"2015-12-02T23:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/angular/angular.js/pulls/13453/commits","review_comments_url":"https://api.github.com/repos/angular/angular.js/pulls/13453/comments","review_comment_url":"https://api.github.com/repos/angular/angular.js/pulls/comments{/number}","comments_url":"https://api.github.com/repos/angular/angular.js/issues/13453/comments","statuses_url":"https://api.github.com/repos/angular/angular.js/statuses/67ce6a6cd0f1c7b68cbccac5b12e990ec4787f2b","head":{"label":"petebacondarwin:svg-use-fix","ref":"svg-use-fix","sha":"67ce6a6cd0f1c7b68cbccac5b12e990ec4787f2b","user":{"login":"petebacondarwin","id":15655,"avatar_url":"https://avatars.githubusercontent.com/u/15655?v=3","gravatar_id":"","url":"https://api.github.com/users/petebacondarwin","html_url":"https://github.com/petebacondarwin","followers_url":"https://api.github.com/users/petebacondarwin/followers","following_url":"https://api.github.com/users/petebacondarwin/following{/other_user}","gists_url":"https://api.github.com/users/petebacondarwin/gists{/gist_id}","starred_url":"https://api.github.com/users/petebacondarwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petebacondarwin/subscriptions","organizations_url":"https://api.github.com/users/petebacondarwin/orgs","repos_url":"https://api.github.com/users/petebacondarwin/repos","events_url":"https://api.github.com/users/petebacondarwin/events{/privacy}","received_events_url":"https://api.github.com/users/petebacondarwin/received_events","type":"User","site_admin":false},"repo":{"id":6367749,"name":"angular.js","full_name":"petebacondarwin/angular.js","owner":{"login":"petebacondarwin","id":15655,"avatar_url":"https://avatars.githubusercontent.com/u/15655?v=3","gravatar_id":"","url":"https://api.github.com/users/petebacondarwin","html_url":"https://github.com/petebacondarwin","followers_url":"https://api.github.com/users/petebacondarwin/followers","following_url":"https://api.github.com/users/petebacondarwin/following{/other_user}","gists_url":"https://api.github.com/users/petebacondarwin/gists{/gist_id}","starred_url":"https://api.github.com/users/petebacondarwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petebacondarwin/subscriptions","organizations_url":"https://api.github.com/users/petebacondarwin/orgs","repos_url":"https://api.github.com/users/petebacondarwin/repos","events_url":"https://api.github.com/users/petebacondarwin/events{/privacy}","received_events_url":"https://api.github.com/users/petebacondarwin/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/petebacondarwin/angular.js","description":"","fork":true,"url":"https://api.github.com/repos/petebacondarwin/angular.js","forks_url":"https://api.github.com/repos/petebacondarwin/angular.js/forks","keys_url":"https://api.github.com/repos/petebacondarwin/angular.js/keys{/key_id}","collaborators_url":"https://api.github.com/repos/petebacondarwin/angular.js/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/petebacondarwin/angular.js/teams","hooks_url":"https://api.github.com/repos/petebacondarwin/angular.js/hooks","issue_events_url":"https://api.github.com/repos/petebacondarwin/angular.js/issues/events{/number}","events_url":"https://api.github.com/repos/petebacondarwin/angular.js/events","assignees_url":"https://api.github.com/repos/petebacondarwin/angular.js/assignees{/user}","branches_url":"https://api.github.com/repos/petebacondarwin/angular.js/branches{/branch}","tags_url":"https://api.github.com/repos/petebacondarwin/angular.js/tags","blobs_url":"https://api.github.com/repos/petebacondarwin/angular.js/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/petebacondarwin/angular.js/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/petebacondarwin/angular.js/git/refs{/sha}","trees_url":"https://api.github.com/repos/petebacondarwin/angular.js/git/trees{/sha}","statuses_url":"https://api.github.com/repos/petebacondarwin/angular.js/statuses/{sha}","languages_url":"https://api.github.com/repos/petebacondarwin/angular.js/languages","stargazers_url":"https://api.github.com/repos/petebacondarwin/angular.js/stargazers","contributors_url":"https://api.github.com/repos/petebacondarwin/angular.js/contributors","subscribers_url":"https://api.github.com/repos/petebacondarwin/angular.js/subscribers","subscription_url":"https://api.github.com/repos/petebacondarwin/angular.js/subscription","commits_url":"https://api.github.com/repos/petebacondarwin/angular.js/commits{/sha}","git_commits_url":"https://api.github.com/repos/petebacondarwin/angular.js/git/commits{/sha}","comments_url":"https://api.github.com/repos/petebacondarwin/angular.js/comments{/number}","issue_comment_url":"https://api.github.com/repos/petebacondarwin/angular.js/issues/comments{/number}","contents_url":"https://api.github.com/repos/petebacondarwin/angular.js/contents/{+path}","compare_url":"https://api.github.com/repos/petebacondarwin/angular.js/compare/{base}...{head}","merges_url":"https://api.github.com/repos/petebacondarwin/angular.js/merges","archive_url":"https://api.github.com/repos/petebacondarwin/angular.js/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/petebacondarwin/angular.js/downloads","issues_url":"https://api.github.com/repos/petebacondarwin/angular.js/issues{/number}","pulls_url":"https://api.github.com/repos/petebacondarwin/angular.js/pulls{/number}","milestones_url":"https://api.github.com/repos/petebacondarwin/angular.js/milestones{/number}","notifications_url":"https://api.github.com/repos/petebacondarwin/angular.js/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/petebacondarwin/angular.js/labels{/name}","releases_url":"https://api.github.com/repos/petebacondarwin/angular.js/releases{/id}","created_at":"2012-10-24T09:47:23Z","updated_at":"2015-05-19T08:10:36Z","pushed_at":"2015-12-05T18:45:29Z","git_url":"git://github.com/petebacondarwin/angular.js.git","ssh_url":"git@github.com:petebacondarwin/angular.js.git","clone_url":"https://github.com/petebacondarwin/angular.js.git","svn_url":"https://github.com/petebacondarwin/angular.js","homepage":"http://angularjs.org","size":80365,"stargazers_count":3,"watchers_count":3,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":3,"default_branch":"master"}},"base":{"label":"angular:master","ref":"master","sha":"e94b37e20e8e37abce0e7d13265298d86d4081fd","user":{"login":"angular","id":139426,"avatar_url":"https://avatars.githubusercontent.com/u/139426?v=3","gravatar_id":"","url":"https://api.github.com/users/angular","html_url":"https://github.com/angular","followers_url":"https://api.github.com/users/angular/followers","following_url":"https://api.github.com/users/angular/following{/other_user}","gists_url":"https://api.github.com/users/angular/gists{/gist_id}","starred_url":"https://api.github.com/users/angular/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/angular/subscriptions","organizations_url":"https://api.github.com/users/angular/orgs","repos_url":"https://api.github.com/users/angular/repos","events_url":"https://api.github.com/users/angular/events{/privacy}","received_events_url":"https://api.github.com/users/angular/received_events","type":"Organization","site_admin":false},"repo":{"id":460078,"name":"angular.js","full_name":"angular/angular.js","owner":{"login":"angular","id":139426,"avatar_url":"https://avatars.githubusercontent.com/u/139426?v=3","gravatar_id":"","url":"https://api.github.com/users/angular","html_url":"https://github.com/angular","followers_url":"https://api.github.com/users/angular/followers","following_url":"https://api.github.com/users/angular/following{/other_user}","gists_url":"https://api.github.com/users/angular/gists{/gist_id}","starred_url":"https://api.github.com/users/angular/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/angular/subscriptions","organizations_url":"https://api.github.com/users/angular/orgs","repos_url":"https://api.github.com/users/angular/repos","events_url":"https://api.github.com/users/angular/events{/privacy}","received_events_url":"https://api.github.com/users/angular/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/angular/angular.js","description":"HTML enhanced for web apps","fork":false,"url":"https://api.github.com/repos/angular/angular.js","forks_url":"https://api.github.com/repos/angular/angular.js/forks","keys_url":"https://api.github.com/repos/angular/angular.js/keys{/key_id}","collaborators_url":"https://api.github.com/repos/angular/angular.js/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/angular/angular.js/teams","hooks_url":"https://api.github.com/repos/angular/angular.js/hooks","issue_events_url":"https://api.github.com/repos/angular/angular.js/issues/events{/number}","events_url":"https://api.github.com/repos/angular/angular.js/events","assignees_url":"https://api.github.com/repos/angular/angular.js/assignees{/user}","branches_url":"https://api.github.com/repos/angular/angular.js/branches{/branch}","tags_url":"https://api.github.com/repos/angular/angular.js/tags","blobs_url":"https://api.github.com/repos/angular/angular.js/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/angular/angular.js/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/angular/angular.js/git/refs{/sha}","trees_url":"https://api.github.com/repos/angular/angular.js/git/trees{/sha}","statuses_url":"https://api.github.com/repos/angular/angular.js/statuses/{sha}","languages_url":"https://api.github.com/repos/angular/angular.js/languages","stargazers_url":"https://api.github.com/repos/angular/angular.js/stargazers","contributors_url":"https://api.github.com/repos/angular/angular.js/contributors","subscribers_url":"https://api.github.com/repos/angular/angular.js/subscribers","subscription_url":"https://api.github.com/repos/angular/angular.js/subscription","commits_url":"https://api.github.com/repos/angular/angular.js/commits{/sha}","git_commits_url":"https://api.github.com/repos/angular/angular.js/git/commits{/sha}","comments_url":"https://api.github.com/repos/angular/angular.js/comments{/number}","issue_comment_url":"https://api.github.com/repos/angular/angular.js/issues/comments{/number}","contents_url":"https://api.github.com/repos/angular/angular.js/contents/{+path}","compare_url":"https://api.github.com/repos/angular/angular.js/compare/{base}...{head}","merges_url":"https://api.github.com/repos/angular/angular.js/merges","archive_url":"https://api.github.com/repos/angular/angular.js/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/angular/angular.js/downloads","issues_url":"https://api.github.com/repos/angular/angular.js/issues{/number}","pulls_url":"https://api.github.com/repos/angular/angular.js/pulls{/number}","milestones_url":"https://api.github.com/repos/angular/angular.js/milestones{/number}","notifications_url":"https://api.github.com/repos/angular/angular.js/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/angular/angular.js/labels{/name}","releases_url":"https://api.github.com/repos/angular/angular.js/releases{/id}","created_at":"2010-01-06T00:34:37Z","updated_at":"2015-12-05T18:39:43Z","pushed_at":"2015-12-05T11:32:23Z","git_url":"git://github.com/angular/angular.js.git","ssh_url":"git@github.com:angular/angular.js.git","clone_url":"https://github.com/angular/angular.js.git","svn_url":"https://github.com/angular/angular.js","homepage":"http://angularjs.org","size":140534,"stargazers_count":44827,"watchers_count":44827,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":20588,"mirror_url":null,"open_issues_count":1243,"forks":20588,"open_issues":1243,"watchers":44827,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/angular/angular.js/pulls/13453"},"html":{"href":"https://github.com/angular/angular.js/pull/13453"},"issue":{"href":"https://api.github.com/repos/angular/angular.js/issues/13453"},"comments":{"href":"https://api.github.com/repos/angular/angular.js/issues/13453/comments"},"review_comments":{"href":"https://api.github.com/repos/angular/angular.js/pulls/13453/comments"},"review_comment":{"href":"https://api.github.com/repos/angular/angular.js/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/angular/angular.js/pulls/13453/commits"},"statuses":{"href":"https://api.github.com/repos/angular/angular.js/statuses/67ce6a6cd0f1c7b68cbccac5b12e990ec4787f2b"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"commits":1,"additions":8,"deletions":1,"changed_files":2}}