{"action":"created","issue":{"url":"https://api.github.com/repos/slimphp/Slim/issues/1034","labels_url":"https://api.github.com/repos/slimphp/Slim/issues/1034/labels{/name}","comments_url":"https://api.github.com/repos/slimphp/Slim/issues/1034/comments","events_url":"https://api.github.com/repos/slimphp/Slim/issues/1034/events","html_url":"https://github.com/slimphp/Slim/issues/1034","id":59414092,"number":1034,"title":"PHP Object Injection Vulnerability in SessionCookie.php","user":{"login":"sarciszewski","id":3710836,"avatar_url":"https://avatars.githubusercontent.com/u/3710836?v=3","gravatar_id":"","url":"https://api.github.com/users/sarciszewski","html_url":"https://github.com/sarciszewski","followers_url":"https://api.github.com/users/sarciszewski/followers","following_url":"https://api.github.com/users/sarciszewski/following{/other_user}","gists_url":"https://api.github.com/users/sarciszewski/gists{/gist_id}","starred_url":"https://api.github.com/users/sarciszewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sarciszewski/subscriptions","organizations_url":"https://api.github.com/users/sarciszewski/orgs","repos_url":"https://api.github.com/users/sarciszewski/repos","events_url":"https://api.github.com/users/sarciszewski/events{/privacy}","received_events_url":"https://api.github.com/users/sarciszewski/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":29,"created_at":"2015-03-01T19:49:12Z","updated_at":"2015-03-01T22:32:40Z","closed_at":null,"body":"https://github.com/slimphp/Slim/blob/master/Slim/Middleware/SessionCookie.php#L127\r\n\r\nGenerally, it's a bad idea to blindly `unserialize()` user-controllable input.\r\n\r\nhttps://www.owasp.org/index.php/PHP_Object_Injection"},"comment":{"url":"https://api.github.com/repos/slimphp/Slim/issues/comments/76635367","html_url":"https://github.com/slimphp/Slim/issues/1034#issuecomment-76635367","issue_url":"https://api.github.com/repos/slimphp/Slim/issues/1034","id":76635367,"user":{"login":"sarciszewski","id":3710836,"avatar_url":"https://avatars.githubusercontent.com/u/3710836?v=3","gravatar_id":"","url":"https://api.github.com/users/sarciszewski","html_url":"https://github.com/sarciszewski","followers_url":"https://api.github.com/users/sarciszewski/followers","following_url":"https://api.github.com/users/sarciszewski/following{/other_user}","gists_url":"https://api.github.com/users/sarciszewski/gists{/gist_id}","starred_url":"https://api.github.com/users/sarciszewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sarciszewski/subscriptions","organizations_url":"https://api.github.com/users/sarciszewski/orgs","repos_url":"https://api.github.com/users/sarciszewski/repos","events_url":"https://api.github.com/users/sarciszewski/events{/privacy}","received_events_url":"https://api.github.com/users/sarciszewski/received_events","type":"User","site_admin":false},"created_at":"2015-03-01T22:32:40Z","updated_at":"2015-03-01T22:32:40Z","body":"Yes, the data is stored serverside, but the identifier is stored in a cookie."}}