{"action":"created","issue":{"url":"https://api.github.com/repos/TeamMentor/TM_4_0_Design/issues/335","labels_url":"https://api.github.com/repos/TeamMentor/TM_4_0_Design/issues/335/labels{/name}","comments_url":"https://api.github.com/repos/TeamMentor/TM_4_0_Design/issues/335/comments","events_url":"https://api.github.com/repos/TeamMentor/TM_4_0_Design/issues/335/events","html_url":"https://github.com/TeamMentor/TM_4_0_Design/issues/335","id":55804790,"number":335,"title":"Vulnerable to directory traversal","user":{"login":"BendixSpring","id":3578332,"avatar_url":"https://avatars.githubusercontent.com/u/3578332?v=3","gravatar_id":"","url":"https://api.github.com/users/BendixSpring","html_url":"https://github.com/BendixSpring","followers_url":"https://api.github.com/users/BendixSpring/followers","following_url":"https://api.github.com/users/BendixSpring/following{/other_user}","gists_url":"https://api.github.com/users/BendixSpring/gists{/gist_id}","starred_url":"https://api.github.com/users/BendixSpring/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BendixSpring/subscriptions","organizations_url":"https://api.github.com/users/BendixSpring/orgs","repos_url":"https://api.github.com/users/BendixSpring/repos","events_url":"https://api.github.com/users/BendixSpring/events{/privacy}","received_events_url":"https://api.github.com/users/BendixSpring/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-01-28T19:41:05Z","updated_at":"2015-01-28T20:37:02Z","closed_at":null,"body":"Doing a search of this:\r\n/on the server.\r\nGives this error message:\r\n Requested URL: /graph/on the server.\r\nNotice /graph/on the server.\r\n\r\nAdding ../ to the front of the message (../on the server.) gives this error message\r\nRequested URL: /on the server.\r\nNotice that we lost /graph and have moved up a directory\r\n"},"comment":{"url":"https://api.github.com/repos/TeamMentor/TM_4_0_Design/issues/comments/71910956","html_url":"https://github.com/TeamMentor/TM_4_0_Design/issues/335#issuecomment-71910956","issue_url":"https://api.github.com/repos/TeamMentor/TM_4_0_Design/issues/335","id":71910956,"user":{"login":"BendixSpring","id":3578332,"avatar_url":"https://avatars.githubusercontent.com/u/3578332?v=3","gravatar_id":"","url":"https://api.github.com/users/BendixSpring","html_url":"https://github.com/BendixSpring","followers_url":"https://api.github.com/users/BendixSpring/followers","following_url":"https://api.github.com/users/BendixSpring/following{/other_user}","gists_url":"https://api.github.com/users/BendixSpring/gists{/gist_id}","starred_url":"https://api.github.com/users/BendixSpring/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BendixSpring/subscriptions","organizations_url":"https://api.github.com/users/BendixSpring/orgs","repos_url":"https://api.github.com/users/BendixSpring/repos","events_url":"https://api.github.com/users/BendixSpring/events{/privacy}","received_events_url":"https://api.github.com/users/BendixSpring/received_events","type":"User","site_admin":false},"created_at":"2015-01-28T20:37:02Z","updated_at":"2015-01-28T20:37:02Z","body":"Here is an example of a search term I used to pull up a page from the web server\r\n../article/view/d898d2a2-f20a-45bb-b232-6713cb618de8/All%20Output%20Data%20Is%20Encoded\r\n\r\nIt's possible that the search engine ignored stuff and just found the page, but if there really is an /article  directory one level above the /graph directory, then maybe this query did pull that page"}}