{"action":"closed","issue":{"url":"https://api.github.com/repos/r888888888/danbooru/issues/1932","labels_url":"https://api.github.com/repos/r888888888/danbooru/issues/1932/labels{/name}","comments_url":"https://api.github.com/repos/r888888888/danbooru/issues/1932/comments","events_url":"https://api.github.com/repos/r888888888/danbooru/issues/1932/events","html_url":"https://github.com/r888888888/danbooru/issues/1932","id":17915974,"number":1932,"title":"CSS in note \"style\" attributes is not sanitized","user":{"login":"kxz","id":4836895,"avatar_url":"https://avatars.githubusercontent.com/u/4836895?v=3","gravatar_id":"","url":"https://api.github.com/users/kxz","html_url":"https://github.com/kxz","followers_url":"https://api.github.com/users/kxz/followers","following_url":"https://api.github.com/users/kxz/following{/other_user}","gists_url":"https://api.github.com/users/kxz/gists{/gist_id}","starred_url":"https://api.github.com/users/kxz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kxz/subscriptions","organizations_url":"https://api.github.com/users/kxz/orgs","repos_url":"https://api.github.com/users/kxz/repos","events_url":"https://api.github.com/users/kxz/events{/privacy}","received_events_url":"https://api.github.com/users/kxz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/r888888888/danbooru/labels/Security","name":"Security","color":"F7FE2E"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2013-08-11T18:30:28Z","updated_at":"2015-05-09T01:11:34Z","closed_at":"2015-05-09T01:11:34Z","body":"It's possible to sneak in JavaScript XSS attacks via `url(javascript:...)`, cover the UI with fixed positioning, etc. I question the need for whitelisting the `style` attribute at all — as far as I can see, virtually all of the notes that use it, use it for effects that can be accomplished with `<font size color bgcolor>` — but if it's allowed, it definitely needs to be cleaned up before it's presented to the user.\r\n\r\nRails 3.2 [includes a CSS sanitizer helper](http://api.rubyonrails.org/v3.2.12/classes/ActionView/Helpers/SanitizeHelper.html), so that is probably a good starting point."}}