{"action":"created","comment":{"url":"https://api.github.com/repos/wso2/carbon-identity/pulls/comments/40654400","id":40654400,"diff_hunk":"@@ -155,24 +156,24 @@\n                 %>\n                 <tr>\n                     <td>\n-                        <a href=\"view-workflow.jsp?<%=WorkflowUIConstants.PARAM_WORKFLOW_ID%>=<%=workflow.getWorkflowId()%>\">\n-                        <%=workflow.getWorkflowName()%>\n+                        <a href=\"view-workflow.jsp?<%=WorkflowUIConstants.PARAM_WORKFLOW_ID%>=<%=Encode.forHtmlAttribute(workflow.getWorkflowId())%>\">\n+                        <%=Encode.forHtmlContent(workflow.getWorkflowName())%>\n                         </a>\n                     </td>\n-                    <td><%=workflow.getWorkflowDescription() == null ? \"\" : workflow.getWorkflowDescription()%>\n+                    <td><%=workflow.getWorkflowDescription() == null ? \"\" : Encode.forHtmlContent(workflow.getWorkflowDescription())%>\n                     </td>\n-                    <td><%=workflow.getTemplate().getName()%>\n+                    <td><%=Encode.forHtmlContent(workflow.getTemplate().getName())%>\n                     </td>\n-                    <td><%=workflow.getWorkflowImpl().getWorkflowImplName()%>\n+                    <td><%=Encode.forHtmlContent(workflow.getWorkflowImpl().getWorkflowImplName())%>\n                     </td>\n                     <td>\n                         <a title=\"<fmt:message key='workflow.service.workflow.edit.title'/>\"\n-                           onclick=\"editWorkflow('<%=workflow.getWorkflowId()%>');\n+                           onclick=\"editWorkflow('<%=Encode.forJavaScriptAttribute(workflow.getWorkflowId())%>');","path":"components/workflow-mgt/org.wso2.carbon.identity.workflow.mgt.ui/src/main/resources/web/workflow-mgt/list-workflows.jsp","position":39,"original_position":39,"commit_id":"1514881e04958a2696aa678c68676215ed4a6f47","original_commit_id":"1514881e04958a2696aa678c68676215ed4a6f47","user":{"login":"malithie","id":4951983,"avatar_url":"https://avatars.githubusercontent.com/u/4951983?v=3","gravatar_id":"","url":"https://api.github.com/users/malithie","html_url":"https://github.com/malithie","followers_url":"https://api.github.com/users/malithie/followers","following_url":"https://api.github.com/users/malithie/following{/other_user}","gists_url":"https://api.github.com/users/malithie/gists{/gist_id}","starred_url":"https://api.github.com/users/malithie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/malithie/subscriptions","organizations_url":"https://api.github.com/users/malithie/orgs","repos_url":"https://api.github.com/users/malithie/repos","events_url":"https://api.github.com/users/malithie/events{/privacy}","received_events_url":"https://api.github.com/users/malithie/received_events","type":"User","site_admin":false},"body":"Passed parameter is used in a query string. So encode for uri component and then encode for javascript attribute","created_at":"2015-09-29T10:06:45Z","updated_at":"2015-09-29T10:06:45Z","html_url":"https://github.com/wso2/carbon-identity/pull/1039#discussion_r40654400","pull_request_url":"https://api.github.com/repos/wso2/carbon-identity/pulls/1039","_links":{"self":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/comments/40654400"},"html":{"href":"https://github.com/wso2/carbon-identity/pull/1039#discussion_r40654400"},"pull_request":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/1039"}}},"pull_request":{"url":"https://api.github.com/repos/wso2/carbon-identity/pulls/1039","id":46241397,"html_url":"https://github.com/wso2/carbon-identity/pull/1039","diff_url":"https://github.com/wso2/carbon-identity/pull/1039.diff","patch_url":"https://github.com/wso2/carbon-identity/pull/1039.patch","issue_url":"https://api.github.com/repos/wso2/carbon-identity/issues/1039","number":1039,"state":"open","locked":false,"title":"Fixing Workflow Related XSS Vulnerabilities","user":{"login":"kasungayan","id":11533672,"avatar_url":"https://avatars.githubusercontent.com/u/11533672?v=3","gravatar_id":"","url":"https://api.github.com/users/kasungayan","html_url":"https://github.com/kasungayan","followers_url":"https://api.github.com/users/kasungayan/followers","following_url":"https://api.github.com/users/kasungayan/following{/other_user}","gists_url":"https://api.github.com/users/kasungayan/gists{/gist_id}","starred_url":"https://api.github.com/users/kasungayan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kasungayan/subscriptions","organizations_url":"https://api.github.com/users/kasungayan/orgs","repos_url":"https://api.github.com/users/kasungayan/repos","events_url":"https://api.github.com/users/kasungayan/events{/privacy}","received_events_url":"https://api.github.com/users/kasungayan/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-09-29T06:41:06Z","updated_at":"2015-09-29T10:06:45Z","closed_at":null,"merged_at":null,"merge_commit_sha":"631a39d7da098c506e917c3c19c8c271162b1567","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/wso2/carbon-identity/pulls/1039/commits","review_comments_url":"https://api.github.com/repos/wso2/carbon-identity/pulls/1039/comments","review_comment_url":"https://api.github.com/repos/wso2/carbon-identity/pulls/comments{/number}","comments_url":"https://api.github.com/repos/wso2/carbon-identity/issues/1039/comments","statuses_url":"https://api.github.com/repos/wso2/carbon-identity/statuses/1514881e04958a2696aa678c68676215ed4a6f47","head":{"label":"kasungayan:Workflow-Final-Xss","ref":"Workflow-Final-Xss","sha":"1514881e04958a2696aa678c68676215ed4a6f47","user":{"login":"kasungayan","id":11533672,"avatar_url":"https://avatars.githubusercontent.com/u/11533672?v=3","gravatar_id":"","url":"https://api.github.com/users/kasungayan","html_url":"https://github.com/kasungayan","followers_url":"https://api.github.com/users/kasungayan/followers","following_url":"https://api.github.com/users/kasungayan/following{/other_user}","gists_url":"https://api.github.com/users/kasungayan/gists{/gist_id}","starred_url":"https://api.github.com/users/kasungayan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kasungayan/subscriptions","organizations_url":"https://api.github.com/users/kasungayan/orgs","repos_url":"https://api.github.com/users/kasungayan/repos","events_url":"https://api.github.com/users/kasungayan/events{/privacy}","received_events_url":"https://api.github.com/users/kasungayan/received_events","type":"User","site_admin":false},"repo":{"id":36638414,"name":"carbon-identity","full_name":"kasungayan/carbon-identity","owner":{"login":"kasungayan","id":11533672,"avatar_url":"https://avatars.githubusercontent.com/u/11533672?v=3","gravatar_id":"","url":"https://api.github.com/users/kasungayan","html_url":"https://github.com/kasungayan","followers_url":"https://api.github.com/users/kasungayan/followers","following_url":"https://api.github.com/users/kasungayan/following{/other_user}","gists_url":"https://api.github.com/users/kasungayan/gists{/gist_id}","starred_url":"https://api.github.com/users/kasungayan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kasungayan/subscriptions","organizations_url":"https://api.github.com/users/kasungayan/orgs","repos_url":"https://api.github.com/users/kasungayan/repos","events_url":"https://api.github.com/users/kasungayan/events{/privacy}","received_events_url":"https://api.github.com/users/kasungayan/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/kasungayan/carbon-identity","description":"","fork":true,"url":"https://api.github.com/repos/kasungayan/carbon-identity","forks_url":"https://api.github.com/repos/kasungayan/carbon-identity/forks","keys_url":"https://api.github.com/repos/kasungayan/carbon-identity/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kasungayan/carbon-identity/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kasungayan/carbon-identity/teams","hooks_url":"https://api.github.com/repos/kasungayan/carbon-identity/hooks","issue_events_url":"https://api.github.com/repos/kasungayan/carbon-identity/issues/events{/number}","events_url":"https://api.github.com/repos/kasungayan/carbon-identity/events","assignees_url":"https://api.github.com/repos/kasungayan/carbon-identity/assignees{/user}","branches_url":"https://api.github.com/repos/kasungayan/carbon-identity/branches{/branch}","tags_url":"https://api.github.com/repos/kasungayan/carbon-identity/tags","blobs_url":"https://api.github.com/repos/kasungayan/carbon-identity/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kasungayan/carbon-identity/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kasungayan/carbon-identity/git/refs{/sha}","trees_url":"https://api.github.com/repos/kasungayan/carbon-identity/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kasungayan/carbon-identity/statuses/{sha}","languages_url":"https://api.github.com/repos/kasungayan/carbon-identity/languages","stargazers_url":"https://api.github.com/repos/kasungayan/carbon-identity/stargazers","contributors_url":"https://api.github.com/repos/kasungayan/carbon-identity/contributors","subscribers_url":"https://api.github.com/repos/kasungayan/carbon-identity/subscribers","subscription_url":"https://api.github.com/repos/kasungayan/carbon-identity/subscription","commits_url":"https://api.github.com/repos/kasungayan/carbon-identity/commits{/sha}","git_commits_url":"https://api.github.com/repos/kasungayan/carbon-identity/git/commits{/sha}","comments_url":"https://api.github.com/repos/kasungayan/carbon-identity/comments{/number}","issue_comment_url":"https://api.github.com/repos/kasungayan/carbon-identity/issues/comments{/number}","contents_url":"https://api.github.com/repos/kasungayan/carbon-identity/contents/{+path}","compare_url":"https://api.github.com/repos/kasungayan/carbon-identity/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kasungayan/carbon-identity/merges","archive_url":"https://api.github.com/repos/kasungayan/carbon-identity/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kasungayan/carbon-identity/downloads","issues_url":"https://api.github.com/repos/kasungayan/carbon-identity/issues{/number}","pulls_url":"https://api.github.com/repos/kasungayan/carbon-identity/pulls{/number}","milestones_url":"https://api.github.com/repos/kasungayan/carbon-identity/milestones{/number}","notifications_url":"https://api.github.com/repos/kasungayan/carbon-identity/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kasungayan/carbon-identity/labels{/name}","releases_url":"https://api.github.com/repos/kasungayan/carbon-identity/releases{/id}","created_at":"2015-06-01T04:47:00Z","updated_at":"2015-06-01T04:47:08Z","pushed_at":"2015-09-29T07:07:09Z","git_url":"git://github.com/kasungayan/carbon-identity.git","ssh_url":"git@github.com:kasungayan/carbon-identity.git","clone_url":"https://github.com/kasungayan/carbon-identity.git","svn_url":"https://github.com/kasungayan/carbon-identity","homepage":null,"size":47051,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"wso2:master","ref":"master","sha":"4685d24581ed960d8f315e7cc27f409f0ba40276","user":{"login":"wso2","id":533043,"avatar_url":"https://avatars.githubusercontent.com/u/533043?v=3","gravatar_id":"","url":"https://api.github.com/users/wso2","html_url":"https://github.com/wso2","followers_url":"https://api.github.com/users/wso2/followers","following_url":"https://api.github.com/users/wso2/following{/other_user}","gists_url":"https://api.github.com/users/wso2/gists{/gist_id}","starred_url":"https://api.github.com/users/wso2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wso2/subscriptions","organizations_url":"https://api.github.com/users/wso2/orgs","repos_url":"https://api.github.com/users/wso2/repos","events_url":"https://api.github.com/users/wso2/events{/privacy}","received_events_url":"https://api.github.com/users/wso2/received_events","type":"Organization","site_admin":false},"repo":{"id":16588204,"name":"carbon-identity","full_name":"wso2/carbon-identity","owner":{"login":"wso2","id":533043,"avatar_url":"https://avatars.githubusercontent.com/u/533043?v=3","gravatar_id":"","url":"https://api.github.com/users/wso2","html_url":"https://github.com/wso2","followers_url":"https://api.github.com/users/wso2/followers","following_url":"https://api.github.com/users/wso2/following{/other_user}","gists_url":"https://api.github.com/users/wso2/gists{/gist_id}","starred_url":"https://api.github.com/users/wso2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wso2/subscriptions","organizations_url":"https://api.github.com/users/wso2/orgs","repos_url":"https://api.github.com/users/wso2/repos","events_url":"https://api.github.com/users/wso2/events{/privacy}","received_events_url":"https://api.github.com/users/wso2/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/wso2/carbon-identity","description":"","fork":false,"url":"https://api.github.com/repos/wso2/carbon-identity","forks_url":"https://api.github.com/repos/wso2/carbon-identity/forks","keys_url":"https://api.github.com/repos/wso2/carbon-identity/keys{/key_id}","collaborators_url":"https://api.github.com/repos/wso2/carbon-identity/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/wso2/carbon-identity/teams","hooks_url":"https://api.github.com/repos/wso2/carbon-identity/hooks","issue_events_url":"https://api.github.com/repos/wso2/carbon-identity/issues/events{/number}","events_url":"https://api.github.com/repos/wso2/carbon-identity/events","assignees_url":"https://api.github.com/repos/wso2/carbon-identity/assignees{/user}","branches_url":"https://api.github.com/repos/wso2/carbon-identity/branches{/branch}","tags_url":"https://api.github.com/repos/wso2/carbon-identity/tags","blobs_url":"https://api.github.com/repos/wso2/carbon-identity/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/wso2/carbon-identity/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/wso2/carbon-identity/git/refs{/sha}","trees_url":"https://api.github.com/repos/wso2/carbon-identity/git/trees{/sha}","statuses_url":"https://api.github.com/repos/wso2/carbon-identity/statuses/{sha}","languages_url":"https://api.github.com/repos/wso2/carbon-identity/languages","stargazers_url":"https://api.github.com/repos/wso2/carbon-identity/stargazers","contributors_url":"https://api.github.com/repos/wso2/carbon-identity/contributors","subscribers_url":"https://api.github.com/repos/wso2/carbon-identity/subscribers","subscription_url":"https://api.github.com/repos/wso2/carbon-identity/subscription","commits_url":"https://api.github.com/repos/wso2/carbon-identity/commits{/sha}","git_commits_url":"https://api.github.com/repos/wso2/carbon-identity/git/commits{/sha}","comments_url":"https://api.github.com/repos/wso2/carbon-identity/comments{/number}","issue_comment_url":"https://api.github.com/repos/wso2/carbon-identity/issues/comments{/number}","contents_url":"https://api.github.com/repos/wso2/carbon-identity/contents/{+path}","compare_url":"https://api.github.com/repos/wso2/carbon-identity/compare/{base}...{head}","merges_url":"https://api.github.com/repos/wso2/carbon-identity/merges","archive_url":"https://api.github.com/repos/wso2/carbon-identity/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/wso2/carbon-identity/downloads","issues_url":"https://api.github.com/repos/wso2/carbon-identity/issues{/number}","pulls_url":"https://api.github.com/repos/wso2/carbon-identity/pulls{/number}","milestones_url":"https://api.github.com/repos/wso2/carbon-identity/milestones{/number}","notifications_url":"https://api.github.com/repos/wso2/carbon-identity/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/wso2/carbon-identity/labels{/name}","releases_url":"https://api.github.com/repos/wso2/carbon-identity/releases{/id}","created_at":"2014-02-06T17:58:23Z","updated_at":"2015-09-17T15:00:40Z","pushed_at":"2015-09-29T09:49:09Z","git_url":"git://github.com/wso2/carbon-identity.git","ssh_url":"git@github.com:wso2/carbon-identity.git","clone_url":"https://github.com/wso2/carbon-identity.git","svn_url":"https://github.com/wso2/carbon-identity","homepage":null,"size":114721,"stargazers_count":7,"watchers_count":7,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":132,"mirror_url":null,"open_issues_count":71,"forks":132,"open_issues":71,"watchers":7,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/1039"},"html":{"href":"https://github.com/wso2/carbon-identity/pull/1039"},"issue":{"href":"https://api.github.com/repos/wso2/carbon-identity/issues/1039"},"comments":{"href":"https://api.github.com/repos/wso2/carbon-identity/issues/1039/comments"},"review_comments":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/1039/comments"},"review_comment":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/1039/commits"},"statuses":{"href":"https://api.github.com/repos/wso2/carbon-identity/statuses/1514881e04958a2696aa678c68676215ed4a6f47"}}}}