{"action":"created","issue":{"url":"https://api.github.com/repos/N07070/n07070-tk-V3/issues/5","labels_url":"https://api.github.com/repos/N07070/n07070-tk-V3/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/N07070/n07070-tk-V3/issues/5/comments","events_url":"https://api.github.com/repos/N07070/n07070-tk-V3/issues/5/events","html_url":"https://github.com/N07070/n07070-tk-V3/pull/5","id":98292611,"number":5,"title":"Remove double escaping in search form + fix SQL injection","user":{"login":"addaleax","id":899444,"avatar_url":"https://avatars.githubusercontent.com/u/899444?v=3","gravatar_id":"","url":"https://api.github.com/users/addaleax","html_url":"https://github.com/addaleax","followers_url":"https://api.github.com/users/addaleax/followers","following_url":"https://api.github.com/users/addaleax/following{/other_user}","gists_url":"https://api.github.com/users/addaleax/gists{/gist_id}","starred_url":"https://api.github.com/users/addaleax/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/addaleax/subscriptions","organizations_url":"https://api.github.com/users/addaleax/orgs","repos_url":"https://api.github.com/users/addaleax/repos","events_url":"https://api.github.com/users/addaleax/events{/privacy}","received_events_url":"https://api.github.com/users/addaleax/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-31T00:31:26Z","updated_at":"2015-07-31T06:23:44Z","closed_at":"2015-07-31T06:22:45Z","pull_request":{"url":"https://api.github.com/repos/N07070/n07070-tk-V3/pulls/5","html_url":"https://github.com/N07070/n07070-tk-V3/pull/5","diff_url":"https://github.com/N07070/n07070-tk-V3/pull/5.diff","patch_url":"https://github.com/N07070/n07070-tk-V3/pull/5.patch"},"body":"Search queries on your site were getting double-escaped and were vulnerable to SQL injection (if properly crafted); Quoting query parameters for usage in SQL strings should be enough to fix this.\r\n\r\nProof of concept for SQL injection (encrypted with your public key):\r\n```\r\n-----BEGIN PGP MESSAGE-----\r\nVersion: GnuPG v1\r\n\r\nhQIMA/T1+d96VXagARAAgDVYbEhIkkcM/kfdtb7n9sU8nQfYt7MTknWHXWExFQXB\r\nBJAX5j9R5ihZa7G0ZVsb0jtwHRp9HVJQZtNG4n9ahyBZp+6hAwwAI2zIWsWv58IW\r\nSQSPIqTKBsK7gfloYFaIAZMUydnG+Bg3gMweq/x2dQ1pL6GXEuSyn+q8w8EPMggA\r\nvx0prQijDCjMDCSzn2K1YXqFRYIVKWS5O4uMMaIzd8V+Wu2PdD/eXpyyBd1pKQmV\r\nl5M6k1LicFHOoOIfw3YYBW5qg/ReTJv9q3nD9NwVhTdnfk5v7KgFUWWBrjYDkmlg\r\nN54sZ+IxVBDztI2SI4/4NgO9ZwROZjAbi3OBkCj3jzRDKOQm3nZURZezSXtkLydw\r\ndUnByzHXQlHYyfDSAENf2/bg/jAEZwiq6RNIU39eADfLf0urEgIMN1m2om9bMB7Q\r\nsUFamq+9gUoLMEbDM6NyLMI471eIpcsk0JCpqhA5GDj4tNb/xwDp4QTQLib5dv4i\r\nurDmkFK2nrbBODkaMVUE5BSdONOVLPDEwGdeNoJYXcFiuYNO0XAzYyuJoUwGihhY\r\nR0dNUrYXXIhaf8ptYbZZIBBeY/yR7s27RooFyHAwu5OAl7WhqMuiP5YIAtIR/SJz\r\nsGcdF9FEdizIrseKgIggyvRIyTV+Ke9JL6zY6y5j9KFAqqDd7LWG8qp7K2OZHDnS\r\nuQFVrwCdGh10Vfa1R5xABNHEnP2ezd35H541wyEVnHigJRKFTiUnauWBRLGSf4XE\r\n44hV5UHDTxg66ok758cf3wMV90TGAWM8Y++CPtvOicqHIGYN6RUDVpdlFug6qkuo\r\nH8r6f6/m/HT/AcLuDOfTDPIxfT4lGk4c8EuWts2NgnZfXmIcm0afqAcavYOrQr6+\r\nrJc/HfqNmgF5I9+ZWpoxzTBd/Uq3hwnbXTgEwtkOPUWrDuD6sKSMPL2Z\r\n=CTtf\r\n-----END PGP MESSAGE-----\r\n```"},"comment":{"url":"https://api.github.com/repos/N07070/n07070-tk-V3/issues/comments/126579468","html_url":"https://github.com/N07070/n07070-tk-V3/pull/5#issuecomment-126579468","issue_url":"https://api.github.com/repos/N07070/n07070-tk-V3/issues/5","id":126579468,"user":{"login":"N07070","id":2259999,"avatar_url":"https://avatars.githubusercontent.com/u/2259999?v=3","gravatar_id":"","url":"https://api.github.com/users/N07070","html_url":"https://github.com/N07070","followers_url":"https://api.github.com/users/N07070/followers","following_url":"https://api.github.com/users/N07070/following{/other_user}","gists_url":"https://api.github.com/users/N07070/gists{/gist_id}","starred_url":"https://api.github.com/users/N07070/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/N07070/subscriptions","organizations_url":"https://api.github.com/users/N07070/orgs","repos_url":"https://api.github.com/users/N07070/repos","events_url":"https://api.github.com/users/N07070/events{/privacy}","received_events_url":"https://api.github.com/users/N07070/received_events","type":"User","site_admin":false},"created_at":"2015-07-31T06:23:44Z","updated_at":"2015-07-31T06:23:44Z","body":"Wow, thanks so much ! I'm fixing this now. :smile: \r\nI learned something now, thanks again !"}}