{"action":"created","comment":{"url":"https://api.github.com/repos/wso2/carbon-identity/pulls/comments/40517782","id":40517782,"diff_hunk":"@@ -220,34 +221,34 @@\n                         }\n \n                 %>\n-                <tr id=<%=domainId%>>\n+                <tr id=<%=Encode.forHtmlAttribute(domainId)%>>\n                     <td style=\"width: 5%;margin-top:10px;\">\n                         <input type=\"checkbox\" name=\"userStores\"\n-                               value=\"<%=domainId%>\"\n+                               value=\"<%=Encode.forHtmlAttribute(domainId)%>\"\n                                onclick=\"resetVars()\"\n                                class=\"chkBox\"/>\n                     </td>\n                     <td style=\"width: 10%;margin-top:10px;\">\n-                        <a><%=domainId%>\n+                        <a><%=Encode.forHtml(domainId)%>\n                         </a>\n                     </td>\n                     <td style=\"width: 40%;margin-top:10px;\">\n-                        <a><%=className%>\n+                        <a><%=Encode.forHtml(className)%>\n                         </a>\n                     </td>\n                     <td style=\"width: 45%;margin-top:10px;\">\n                         <a title=\"<fmt:message key='edit.userstore'/>\"\n-                           onclick=\"edit('<%=domainId%>','<%=className%>');\"\n+                           onclick=\"edit('<%=Encode.forJavaScriptAttribute(domainId)%>','<%=Encode.forJavaScriptAttribute(className)%>');\"","path":"components/user-store/org.wso2.carbon.identity.user.store.configuration.ui/src/main/resources/web/userstore_config/index.jsp","position":34,"original_position":34,"commit_id":"8072ac25baaed1de7f41d1426950ab3893febf8e","original_commit_id":"8072ac25baaed1de7f41d1426950ab3893febf8e","user":{"login":"malithie","id":4951983,"avatar_url":"https://avatars.githubusercontent.com/u/4951983?v=3","gravatar_id":"","url":"https://api.github.com/users/malithie","html_url":"https://github.com/malithie","followers_url":"https://api.github.com/users/malithie/followers","following_url":"https://api.github.com/users/malithie/following{/other_user}","gists_url":"https://api.github.com/users/malithie/gists{/gist_id}","starred_url":"https://api.github.com/users/malithie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/malithie/subscriptions","organizations_url":"https://api.github.com/users/malithie/orgs","repos_url":"https://api.github.com/users/malithie/repos","events_url":"https://api.github.com/users/malithie/events{/privacy}","received_events_url":"https://api.github.com/users/malithie/received_events","type":"User","site_admin":false},"body":"encode domainId and className for URI and then encode for javascript attribute. This is because within the edit function both of these attributes are used in the query string of a form action","created_at":"2015-09-28T04:24:36Z","updated_at":"2015-09-28T04:24:36Z","html_url":"https://github.com/wso2/carbon-identity/pull/986#discussion_r40517782","pull_request_url":"https://api.github.com/repos/wso2/carbon-identity/pulls/986","_links":{"self":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/comments/40517782"},"html":{"href":"https://github.com/wso2/carbon-identity/pull/986#discussion_r40517782"},"pull_request":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/986"}}},"pull_request":{"url":"https://api.github.com/repos/wso2/carbon-identity/pulls/986","id":45748166,"html_url":"https://github.com/wso2/carbon-identity/pull/986","diff_url":"https://github.com/wso2/carbon-identity/pull/986.diff","patch_url":"https://github.com/wso2/carbon-identity/pull/986.patch","issue_url":"https://api.github.com/repos/wso2/carbon-identity/issues/986","number":986,"state":"open","locked":false,"title":"fixing xss vulnerability","user":{"login":"GayanM","id":3436694,"avatar_url":"https://avatars.githubusercontent.com/u/3436694?v=3","gravatar_id":"","url":"https://api.github.com/users/GayanM","html_url":"https://github.com/GayanM","followers_url":"https://api.github.com/users/GayanM/followers","following_url":"https://api.github.com/users/GayanM/following{/other_user}","gists_url":"https://api.github.com/users/GayanM/gists{/gist_id}","starred_url":"https://api.github.com/users/GayanM/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GayanM/subscriptions","organizations_url":"https://api.github.com/users/GayanM/orgs","repos_url":"https://api.github.com/users/GayanM/repos","events_url":"https://api.github.com/users/GayanM/events{/privacy}","received_events_url":"https://api.github.com/users/GayanM/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-09-23T06:51:57Z","updated_at":"2015-09-28T04:24:36Z","closed_at":null,"merged_at":null,"merge_commit_sha":"72fbedbc6ef5317c46c73a6fec02147db80f849a","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/wso2/carbon-identity/pulls/986/commits","review_comments_url":"https://api.github.com/repos/wso2/carbon-identity/pulls/986/comments","review_comment_url":"https://api.github.com/repos/wso2/carbon-identity/pulls/comments{/number}","comments_url":"https://api.github.com/repos/wso2/carbon-identity/issues/986/comments","statuses_url":"https://api.github.com/repos/wso2/carbon-identity/statuses/8072ac25baaed1de7f41d1426950ab3893febf8e","head":{"label":"GayanM:xssuserstore","ref":"xssuserstore","sha":"8072ac25baaed1de7f41d1426950ab3893febf8e","user":{"login":"GayanM","id":3436694,"avatar_url":"https://avatars.githubusercontent.com/u/3436694?v=3","gravatar_id":"","url":"https://api.github.com/users/GayanM","html_url":"https://github.com/GayanM","followers_url":"https://api.github.com/users/GayanM/followers","following_url":"https://api.github.com/users/GayanM/following{/other_user}","gists_url":"https://api.github.com/users/GayanM/gists{/gist_id}","starred_url":"https://api.github.com/users/GayanM/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GayanM/subscriptions","organizations_url":"https://api.github.com/users/GayanM/orgs","repos_url":"https://api.github.com/users/GayanM/repos","events_url":"https://api.github.com/users/GayanM/events{/privacy}","received_events_url":"https://api.github.com/users/GayanM/received_events","type":"User","site_admin":false},"repo":{"id":38152023,"name":"carbon-identity","full_name":"GayanM/carbon-identity","owner":{"login":"GayanM","id":3436694,"avatar_url":"https://avatars.githubusercontent.com/u/3436694?v=3","gravatar_id":"","url":"https://api.github.com/users/GayanM","html_url":"https://github.com/GayanM","followers_url":"https://api.github.com/users/GayanM/followers","following_url":"https://api.github.com/users/GayanM/following{/other_user}","gists_url":"https://api.github.com/users/GayanM/gists{/gist_id}","starred_url":"https://api.github.com/users/GayanM/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GayanM/subscriptions","organizations_url":"https://api.github.com/users/GayanM/orgs","repos_url":"https://api.github.com/users/GayanM/repos","events_url":"https://api.github.com/users/GayanM/events{/privacy}","received_events_url":"https://api.github.com/users/GayanM/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/GayanM/carbon-identity","description":"","fork":true,"url":"https://api.github.com/repos/GayanM/carbon-identity","forks_url":"https://api.github.com/repos/GayanM/carbon-identity/forks","keys_url":"https://api.github.com/repos/GayanM/carbon-identity/keys{/key_id}","collaborators_url":"https://api.github.com/repos/GayanM/carbon-identity/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/GayanM/carbon-identity/teams","hooks_url":"https://api.github.com/repos/GayanM/carbon-identity/hooks","issue_events_url":"https://api.github.com/repos/GayanM/carbon-identity/issues/events{/number}","events_url":"https://api.github.com/repos/GayanM/carbon-identity/events","assignees_url":"https://api.github.com/repos/GayanM/carbon-identity/assignees{/user}","branches_url":"https://api.github.com/repos/GayanM/carbon-identity/branches{/branch}","tags_url":"https://api.github.com/repos/GayanM/carbon-identity/tags","blobs_url":"https://api.github.com/repos/GayanM/carbon-identity/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/GayanM/carbon-identity/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/GayanM/carbon-identity/git/refs{/sha}","trees_url":"https://api.github.com/repos/GayanM/carbon-identity/git/trees{/sha}","statuses_url":"https://api.github.com/repos/GayanM/carbon-identity/statuses/{sha}","languages_url":"https://api.github.com/repos/GayanM/carbon-identity/languages","stargazers_url":"https://api.github.com/repos/GayanM/carbon-identity/stargazers","contributors_url":"https://api.github.com/repos/GayanM/carbon-identity/contributors","subscribers_url":"https://api.github.com/repos/GayanM/carbon-identity/subscribers","subscription_url":"https://api.github.com/repos/GayanM/carbon-identity/subscription","commits_url":"https://api.github.com/repos/GayanM/carbon-identity/commits{/sha}","git_commits_url":"https://api.github.com/repos/GayanM/carbon-identity/git/commits{/sha}","comments_url":"https://api.github.com/repos/GayanM/carbon-identity/comments{/number}","issue_comment_url":"https://api.github.com/repos/GayanM/carbon-identity/issues/comments{/number}","contents_url":"https://api.github.com/repos/GayanM/carbon-identity/contents/{+path}","compare_url":"https://api.github.com/repos/GayanM/carbon-identity/compare/{base}...{head}","merges_url":"https://api.github.com/repos/GayanM/carbon-identity/merges","archive_url":"https://api.github.com/repos/GayanM/carbon-identity/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/GayanM/carbon-identity/downloads","issues_url":"https://api.github.com/repos/GayanM/carbon-identity/issues{/number}","pulls_url":"https://api.github.com/repos/GayanM/carbon-identity/pulls{/number}","milestones_url":"https://api.github.com/repos/GayanM/carbon-identity/milestones{/number}","notifications_url":"https://api.github.com/repos/GayanM/carbon-identity/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/GayanM/carbon-identity/labels{/name}","releases_url":"https://api.github.com/repos/GayanM/carbon-identity/releases{/id}","created_at":"2015-06-27T07:51:05Z","updated_at":"2015-06-27T07:51:16Z","pushed_at":"2015-09-27T19:32:41Z","git_url":"git://github.com/GayanM/carbon-identity.git","ssh_url":"git@github.com:GayanM/carbon-identity.git","clone_url":"https://github.com/GayanM/carbon-identity.git","svn_url":"https://github.com/GayanM/carbon-identity","homepage":null,"size":47032,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"wso2:master","ref":"master","sha":"e009f717355bda4c2ca179a1be6c89439443695e","user":{"login":"wso2","id":533043,"avatar_url":"https://avatars.githubusercontent.com/u/533043?v=3","gravatar_id":"","url":"https://api.github.com/users/wso2","html_url":"https://github.com/wso2","followers_url":"https://api.github.com/users/wso2/followers","following_url":"https://api.github.com/users/wso2/following{/other_user}","gists_url":"https://api.github.com/users/wso2/gists{/gist_id}","starred_url":"https://api.github.com/users/wso2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wso2/subscriptions","organizations_url":"https://api.github.com/users/wso2/orgs","repos_url":"https://api.github.com/users/wso2/repos","events_url":"https://api.github.com/users/wso2/events{/privacy}","received_events_url":"https://api.github.com/users/wso2/received_events","type":"Organization","site_admin":false},"repo":{"id":16588204,"name":"carbon-identity","full_name":"wso2/carbon-identity","owner":{"login":"wso2","id":533043,"avatar_url":"https://avatars.githubusercontent.com/u/533043?v=3","gravatar_id":"","url":"https://api.github.com/users/wso2","html_url":"https://github.com/wso2","followers_url":"https://api.github.com/users/wso2/followers","following_url":"https://api.github.com/users/wso2/following{/other_user}","gists_url":"https://api.github.com/users/wso2/gists{/gist_id}","starred_url":"https://api.github.com/users/wso2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wso2/subscriptions","organizations_url":"https://api.github.com/users/wso2/orgs","repos_url":"https://api.github.com/users/wso2/repos","events_url":"https://api.github.com/users/wso2/events{/privacy}","received_events_url":"https://api.github.com/users/wso2/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/wso2/carbon-identity","description":"","fork":false,"url":"https://api.github.com/repos/wso2/carbon-identity","forks_url":"https://api.github.com/repos/wso2/carbon-identity/forks","keys_url":"https://api.github.com/repos/wso2/carbon-identity/keys{/key_id}","collaborators_url":"https://api.github.com/repos/wso2/carbon-identity/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/wso2/carbon-identity/teams","hooks_url":"https://api.github.com/repos/wso2/carbon-identity/hooks","issue_events_url":"https://api.github.com/repos/wso2/carbon-identity/issues/events{/number}","events_url":"https://api.github.com/repos/wso2/carbon-identity/events","assignees_url":"https://api.github.com/repos/wso2/carbon-identity/assignees{/user}","branches_url":"https://api.github.com/repos/wso2/carbon-identity/branches{/branch}","tags_url":"https://api.github.com/repos/wso2/carbon-identity/tags","blobs_url":"https://api.github.com/repos/wso2/carbon-identity/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/wso2/carbon-identity/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/wso2/carbon-identity/git/refs{/sha}","trees_url":"https://api.github.com/repos/wso2/carbon-identity/git/trees{/sha}","statuses_url":"https://api.github.com/repos/wso2/carbon-identity/statuses/{sha}","languages_url":"https://api.github.com/repos/wso2/carbon-identity/languages","stargazers_url":"https://api.github.com/repos/wso2/carbon-identity/stargazers","contributors_url":"https://api.github.com/repos/wso2/carbon-identity/contributors","subscribers_url":"https://api.github.com/repos/wso2/carbon-identity/subscribers","subscription_url":"https://api.github.com/repos/wso2/carbon-identity/subscription","commits_url":"https://api.github.com/repos/wso2/carbon-identity/commits{/sha}","git_commits_url":"https://api.github.com/repos/wso2/carbon-identity/git/commits{/sha}","comments_url":"https://api.github.com/repos/wso2/carbon-identity/comments{/number}","issue_comment_url":"https://api.github.com/repos/wso2/carbon-identity/issues/comments{/number}","contents_url":"https://api.github.com/repos/wso2/carbon-identity/contents/{+path}","compare_url":"https://api.github.com/repos/wso2/carbon-identity/compare/{base}...{head}","merges_url":"https://api.github.com/repos/wso2/carbon-identity/merges","archive_url":"https://api.github.com/repos/wso2/carbon-identity/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/wso2/carbon-identity/downloads","issues_url":"https://api.github.com/repos/wso2/carbon-identity/issues{/number}","pulls_url":"https://api.github.com/repos/wso2/carbon-identity/pulls{/number}","milestones_url":"https://api.github.com/repos/wso2/carbon-identity/milestones{/number}","notifications_url":"https://api.github.com/repos/wso2/carbon-identity/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/wso2/carbon-identity/labels{/name}","releases_url":"https://api.github.com/repos/wso2/carbon-identity/releases{/id}","created_at":"2014-02-06T17:58:23Z","updated_at":"2015-09-17T15:00:40Z","pushed_at":"2015-09-28T04:19:55Z","git_url":"git://github.com/wso2/carbon-identity.git","ssh_url":"git@github.com:wso2/carbon-identity.git","clone_url":"https://github.com/wso2/carbon-identity.git","svn_url":"https://github.com/wso2/carbon-identity","homepage":null,"size":113443,"stargazers_count":7,"watchers_count":7,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":132,"mirror_url":null,"open_issues_count":84,"forks":132,"open_issues":84,"watchers":7,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/986"},"html":{"href":"https://github.com/wso2/carbon-identity/pull/986"},"issue":{"href":"https://api.github.com/repos/wso2/carbon-identity/issues/986"},"comments":{"href":"https://api.github.com/repos/wso2/carbon-identity/issues/986/comments"},"review_comments":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/986/comments"},"review_comment":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/wso2/carbon-identity/pulls/986/commits"},"statuses":{"href":"https://api.github.com/repos/wso2/carbon-identity/statuses/8072ac25baaed1de7f41d1426950ab3893febf8e"}}}}