{"action":"created","issue":{"url":"https://api.github.com/repos/Automattic/jetpack/issues/1934","labels_url":"https://api.github.com/repos/Automattic/jetpack/issues/1934/labels{/name}","comments_url":"https://api.github.com/repos/Automattic/jetpack/issues/1934/comments","events_url":"https://api.github.com/repos/Automattic/jetpack/issues/1934/events","html_url":"https://github.com/Automattic/jetpack/issues/1934","id":67160017,"number":1934,"title":"Sanitize IP headers","user":{"login":"samhotchkiss","id":574752,"avatar_url":"https://avatars.githubusercontent.com/u/574752?v=3","gravatar_id":"","url":"https://api.github.com/users/samhotchkiss","html_url":"https://github.com/samhotchkiss","followers_url":"https://api.github.com/users/samhotchkiss/followers","following_url":"https://api.github.com/users/samhotchkiss/following{/other_user}","gists_url":"https://api.github.com/users/samhotchkiss/gists{/gist_id}","starred_url":"https://api.github.com/users/samhotchkiss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/samhotchkiss/subscriptions","organizations_url":"https://api.github.com/users/samhotchkiss/orgs","repos_url":"https://api.github.com/users/samhotchkiss/repos","events_url":"https://api.github.com/users/samhotchkiss/events{/privacy}","received_events_url":"https://api.github.com/users/samhotchkiss/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Automattic/jetpack/labels/Protect","name":"Protect","color":"bc460b"}],"state":"open","locked":false,"assignee":{"login":"samhotchkiss","id":574752,"avatar_url":"https://avatars.githubusercontent.com/u/574752?v=3","gravatar_id":"","url":"https://api.github.com/users/samhotchkiss","html_url":"https://github.com/samhotchkiss","followers_url":"https://api.github.com/users/samhotchkiss/followers","following_url":"https://api.github.com/users/samhotchkiss/following{/other_user}","gists_url":"https://api.github.com/users/samhotchkiss/gists{/gist_id}","starred_url":"https://api.github.com/users/samhotchkiss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/samhotchkiss/subscriptions","organizations_url":"https://api.github.com/users/samhotchkiss/orgs","repos_url":"https://api.github.com/users/samhotchkiss/repos","events_url":"https://api.github.com/users/samhotchkiss/events{/privacy}","received_events_url":"https://api.github.com/users/samhotchkiss/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/Automattic/jetpack/milestones/18","html_url":"https://github.com/Automattic/jetpack/milestones/3.4.2","labels_url":"https://api.github.com/repos/Automattic/jetpack/milestones/18/labels","id":1029625,"number":18,"title":"3.4.2","description":null,"creator":{"login":"kraftbj","id":88897,"avatar_url":"https://avatars.githubusercontent.com/u/88897?v=3","gravatar_id":"","url":"https://api.github.com/users/kraftbj","html_url":"https://github.com/kraftbj","followers_url":"https://api.github.com/users/kraftbj/followers","following_url":"https://api.github.com/users/kraftbj/following{/other_user}","gists_url":"https://api.github.com/users/kraftbj/gists{/gist_id}","starred_url":"https://api.github.com/users/kraftbj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kraftbj/subscriptions","organizations_url":"https://api.github.com/users/kraftbj/orgs","repos_url":"https://api.github.com/users/kraftbj/repos","events_url":"https://api.github.com/users/kraftbj/events{/privacy}","received_events_url":"https://api.github.com/users/kraftbj/received_events","type":"User","site_admin":false},"open_issues":52,"closed_issues":12,"state":"open","created_at":"2015-03-19T16:41:29Z","updated_at":"2015-04-08T18:34:32Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-04-08T15:47:33Z","updated_at":"2015-04-08T23:20:37Z","closed_at":null,"body":"So people can't inject their own headers and get back stuff like:\r\n\r\n`Your IP (<hola>88.139.175.7) has been flagged for potential security violations...`"},"comment":{"url":"https://api.github.com/repos/Automattic/jetpack/issues/comments/91065292","html_url":"https://github.com/Automattic/jetpack/issues/1934#issuecomment-91065292","issue_url":"https://api.github.com/repos/Automattic/jetpack/issues/1934","id":91065292,"user":{"login":"attritionorg","id":3095424,"avatar_url":"https://avatars.githubusercontent.com/u/3095424?v=3","gravatar_id":"","url":"https://api.github.com/users/attritionorg","html_url":"https://github.com/attritionorg","followers_url":"https://api.github.com/users/attritionorg/followers","following_url":"https://api.github.com/users/attritionorg/following{/other_user}","gists_url":"https://api.github.com/users/attritionorg/gists{/gist_id}","starred_url":"https://api.github.com/users/attritionorg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/attritionorg/subscriptions","organizations_url":"https://api.github.com/users/attritionorg/orgs","repos_url":"https://api.github.com/users/attritionorg/repos","events_url":"https://api.github.com/users/attritionorg/events{/privacy}","received_events_url":"https://api.github.com/users/attritionorg/received_events","type":"User","site_admin":false},"created_at":"2015-04-08T23:20:36Z","updated_at":"2015-04-08T23:20:36Z","body":"Is this just a silly bug that allows you to inject text into your own response, or can this be used for a reflected XSS attack? i.e. Will it return back full script tags and render them?"}}