{"action":"created","issue":{"url":"https://api.github.com/repos/sebastianjaszczur/aplikacjawww/issues/10","labels_url":"https://api.github.com/repos/sebastianjaszczur/aplikacjawww/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/sebastianjaszczur/aplikacjawww/issues/10/comments","events_url":"https://api.github.com/repos/sebastianjaszczur/aplikacjawww/issues/10/events","html_url":"https://github.com/sebastianjaszczur/aplikacjawww/issues/10","id":66235449,"number":10,"title":"Whitelista tagów do edytora","user":{"login":"sebastianjaszczur","id":2011906,"avatar_url":"https://avatars.githubusercontent.com/u/2011906?v=3","gravatar_id":"","url":"https://api.github.com/users/sebastianjaszczur","html_url":"https://github.com/sebastianjaszczur","followers_url":"https://api.github.com/users/sebastianjaszczur/followers","following_url":"https://api.github.com/users/sebastianjaszczur/following{/other_user}","gists_url":"https://api.github.com/users/sebastianjaszczur/gists{/gist_id}","starred_url":"https://api.github.com/users/sebastianjaszczur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sebastianjaszczur/subscriptions","organizations_url":"https://api.github.com/users/sebastianjaszczur/orgs","repos_url":"https://api.github.com/users/sebastianjaszczur/repos","events_url":"https://api.github.com/users/sebastianjaszczur/events{/privacy}","received_events_url":"https://api.github.com/users/sebastianjaszczur/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/sebastianjaszczur/aplikacjawww/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"sebastianjaszczur","id":2011906,"avatar_url":"https://avatars.githubusercontent.com/u/2011906?v=3","gravatar_id":"","url":"https://api.github.com/users/sebastianjaszczur","html_url":"https://github.com/sebastianjaszczur","followers_url":"https://api.github.com/users/sebastianjaszczur/followers","following_url":"https://api.github.com/users/sebastianjaszczur/following{/other_user}","gists_url":"https://api.github.com/users/sebastianjaszczur/gists{/gist_id}","starred_url":"https://api.github.com/users/sebastianjaszczur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sebastianjaszczur/subscriptions","organizations_url":"https://api.github.com/users/sebastianjaszczur/orgs","repos_url":"https://api.github.com/users/sebastianjaszczur/repos","events_url":"https://api.github.com/users/sebastianjaszczur/events{/privacy}","received_events_url":"https://api.github.com/users/sebastianjaszczur/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-04-03T21:53:30Z","updated_at":"2015-04-05T01:19:53Z","closed_at":null,"body":"Jeśli chcemy dać CKEditor do edycji \"osobom niezaufanym\" - np. (potencjalnym) prowadzącym warsztatów - to nie można przepuszczać dowolnego skryptu. Czyli trzeba mieć white-listę tagów i robić walidację."},"comment":{"url":"https://api.github.com/repos/sebastianjaszczur/aplikacjawww/issues/comments/89697577","html_url":"https://github.com/sebastianjaszczur/aplikacjawww/issues/10#issuecomment-89697577","issue_url":"https://api.github.com/repos/sebastianjaszczur/aplikacjawww/issues/10","id":89697577,"user":{"login":"sebastianjaszczur","id":2011906,"avatar_url":"https://avatars.githubusercontent.com/u/2011906?v=3","gravatar_id":"","url":"https://api.github.com/users/sebastianjaszczur","html_url":"https://github.com/sebastianjaszczur","followers_url":"https://api.github.com/users/sebastianjaszczur/followers","following_url":"https://api.github.com/users/sebastianjaszczur/following{/other_user}","gists_url":"https://api.github.com/users/sebastianjaszczur/gists{/gist_id}","starred_url":"https://api.github.com/users/sebastianjaszczur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sebastianjaszczur/subscriptions","organizations_url":"https://api.github.com/users/sebastianjaszczur/orgs","repos_url":"https://api.github.com/users/sebastianjaszczur/repos","events_url":"https://api.github.com/users/sebastianjaszczur/events{/privacy}","received_events_url":"https://api.github.com/users/sebastianjaszczur/received_events","type":"User","site_admin":false},"created_at":"2015-04-05T01:19:53Z","updated_at":"2015-04-05T01:19:53Z","body":"Bleach już jest. W CKEditorze wygenerowałem wszystkie możliwe (chyba) tagi, atrybuty i style - i wrzuciłem do whitelisty (i nic więcej).\r\nNa razie używane jest |bleach - co ma taką zaletę, że każdy kod jest zapisywany, nawet potencjalnie groźny. Jednak obawiam się, że CKEditor nie jest zbyt mądry i możliwe będzie uruchomienie JS w momencie, gdy ktoś zacznie edytować stronę - bo bleach działa na wyświetlany artykuł/warsztaty, ale nie na content wyświetlany w edytorze. Odtworzyć jakiegoś scenariusza ataku mi się nie udało, ale późno jest.\r\n\r\nW każdym razie - ktoś też musiałby przejrzeć tagi/atrybuty/style i potwierdzić, że są OK wszystkie. Plik jest tutaj:\r\nhttps://github.com/sebastianjaszczur/aplikacjawww/blob/master/wwwapp/settings.py\r\nPoproszę jutro o to Kalmara."}}