{"action":"opened","issue":{"url":"https://api.github.com/repos/glowing-bear/glowing-bear/issues/655","labels_url":"https://api.github.com/repos/glowing-bear/glowing-bear/issues/655/labels{/name}","comments_url":"https://api.github.com/repos/glowing-bear/glowing-bear/issues/655/comments","events_url":"https://api.github.com/repos/glowing-bear/glowing-bear/issues/655/events","html_url":"https://github.com/glowing-bear/glowing-bear/issues/655","id":111879167,"number":655,"title":"Cross Site Scripting / XSS in Image Loading","user":{"login":"alexschneider","id":5846376,"avatar_url":"https://avatars.githubusercontent.com/u/5846376?v=3","gravatar_id":"","url":"https://api.github.com/users/alexschneider","html_url":"https://github.com/alexschneider","followers_url":"https://api.github.com/users/alexschneider/followers","following_url":"https://api.github.com/users/alexschneider/following{/other_user}","gists_url":"https://api.github.com/users/alexschneider/gists{/gist_id}","starred_url":"https://api.github.com/users/alexschneider/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexschneider/subscriptions","organizations_url":"https://api.github.com/users/alexschneider/orgs","repos_url":"https://api.github.com/users/alexschneider/repos","events_url":"https://api.github.com/users/alexschneider/events{/privacy}","received_events_url":"https://api.github.com/users/alexschneider/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-16T17:51:20Z","updated_at":"2015-10-16T17:51:20Z","closed_at":null,"body":"```\r\nhttp://google.com\"onmouseover=\"alert(JSON.stringify(localStorage, null, 2));//.png\r\n```\r\n\r\nIf you paste this link and someone using glowing bear mouses over the image, it pops up an alert box with the contents of the local storage (including the weechat host and password if it's stored!). This allows an attacker to gain arbitrary command execution on the host's box (perhaps by installing https://weechat.org/scripts/source/shell.py.html/ or something).  Here's a good link as to what it is and why it is bad: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) and here is a good link as to how to fix it: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet and https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet\r\n\r\nI noticed a number of places where you guys are directly concatenating input into the DOM - PLEASE don't do this. I believe Angular has built in methods to sanitize and escape input, and you shouldn't be creating an element using a string. \r\n![xss](https://cloud.githubusercontent.com/assets/5846376/10549086/c0a010fe-73f3-11e5-984d-dcd48eafab56.png)\r\n\r\n\r\nThis is a SERIOUSLY high priority bug and I **STRONGLY** recommend fixing this ASAP. "}}