{"action":"opened","issue":{"url":"https://api.github.com/repos/phezco/phez/issues/7","labels_url":"https://api.github.com/repos/phezco/phez/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/phezco/phez/issues/7/comments","events_url":"https://api.github.com/repos/phezco/phez/issues/7/events","html_url":"https://github.com/phezco/phez/issues/7","id":95171621,"number":7,"title":"Review input sanitization method for improvements","user":{"login":"phezco","id":13238336,"avatar_url":"https://avatars.githubusercontent.com/u/13238336?v=3","gravatar_id":"","url":"https://api.github.com/users/phezco","html_url":"https://github.com/phezco","followers_url":"https://api.github.com/users/phezco/followers","following_url":"https://api.github.com/users/phezco/following{/other_user}","gists_url":"https://api.github.com/users/phezco/gists{/gist_id}","starred_url":"https://api.github.com/users/phezco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phezco/subscriptions","organizations_url":"https://api.github.com/users/phezco/orgs","repos_url":"https://api.github.com/users/phezco/repos","events_url":"https://api.github.com/users/phezco/events{/privacy}","received_events_url":"https://api.github.com/users/phezco/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-15T11:43:28Z","updated_at":"2015-07-15T11:43:28Z","closed_at":null,"body":"I've pushed an update that centralizes the sanitization code into a new model:\r\nhttps://github.com/phezco/phez/blob/master/app/models/sanitizer.rb\r\n\r\nI like the idea of sanitizing attributes before they ever hit the database. Now the app assumes data coming from the database has been sanitized of nasty XSS attack vectors, etc. So you'll see things like this in the view:\r\n```\r\n<%= raw(@comment.body_rendered) %>\r\n```\r\n\r\nOne problem is that to support markdown quotes, the markdown processor expects \">\" symbols instead of escaped &gt; .\r\n\r\nSo I'm putting the \">\" symbols back in sanitizer.rb. Is this dangerous?  Other thoughts?"}}