{"action":"created","issue":{"url":"https://api.github.com/repos/meanjs/mean/issues/1106","labels_url":"https://api.github.com/repos/meanjs/mean/issues/1106/labels{/name}","comments_url":"https://api.github.com/repos/meanjs/mean/issues/1106/comments","events_url":"https://api.github.com/repos/meanjs/mean/issues/1106/events","html_url":"https://github.com/meanjs/mean/issues/1106","id":122398141,"number":1106,"title":"Potential stored xss issue?","user":{"login":"apitts","id":4076720,"avatar_url":"https://avatars.githubusercontent.com/u/4076720?v=3","gravatar_id":"","url":"https://api.github.com/users/apitts","html_url":"https://github.com/apitts","followers_url":"https://api.github.com/users/apitts/followers","following_url":"https://api.github.com/users/apitts/following{/other_user}","gists_url":"https://api.github.com/users/apitts/gists{/gist_id}","starred_url":"https://api.github.com/users/apitts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apitts/subscriptions","organizations_url":"https://api.github.com/users/apitts/orgs","repos_url":"https://api.github.com/users/apitts/repos","events_url":"https://api.github.com/users/apitts/events{/privacy}","received_events_url":"https://api.github.com/users/apitts/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-12-16T00:15:01Z","updated_at":"2015-12-16T04:13:54Z","closed_at":null,"body":"Here:\r\nhttps://github.com/meanjs/mean/blob/3a4c51aaeebb492afccf70c6049fcae69a37c84e/modules/core/server/views/layout.server.view.html#L48\r\n\r\nI am thinking about stored xss in the user object (e.g. signup with a script as a user name).\r\n\r\nLet me know if I've missed where this would be filtered out elsewhere please."},"comment":{"url":"https://api.github.com/repos/meanjs/mean/issues/comments/164988130","html_url":"https://github.com/meanjs/mean/issues/1106#issuecomment-164988130","issue_url":"https://api.github.com/repos/meanjs/mean/issues/1106","id":164988130,"user":{"login":"apitts","id":4076720,"avatar_url":"https://avatars.githubusercontent.com/u/4076720?v=3","gravatar_id":"","url":"https://api.github.com/users/apitts","html_url":"https://github.com/apitts","followers_url":"https://api.github.com/users/apitts/followers","following_url":"https://api.github.com/users/apitts/following{/other_user}","gists_url":"https://api.github.com/users/apitts/gists{/gist_id}","starred_url":"https://api.github.com/users/apitts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apitts/subscriptions","organizations_url":"https://api.github.com/users/apitts/orgs","repos_url":"https://api.github.com/users/apitts/repos","events_url":"https://api.github.com/users/apitts/events{/privacy}","received_events_url":"https://api.github.com/users/apitts/received_events","type":"User","site_admin":false},"created_at":"2015-12-16T04:13:54Z","updated_at":"2015-12-16T04:13:54Z","body":"Correction: views with other usernames will of course be sanitized by angular...so, yeah, probably not a major security issue."}}