{"action":"opened","issue":{"url":"https://api.github.com/repos/partygoer/partygoer-api/issues/9","labels_url":"https://api.github.com/repos/partygoer/partygoer-api/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/partygoer/partygoer-api/issues/9/comments","events_url":"https://api.github.com/repos/partygoer/partygoer-api/issues/9/events","html_url":"https://github.com/partygoer/partygoer-api/issues/9","id":59359066,"number":9,"title":"Faye vulnerable to wildcard subscriptions","user":{"login":"andrewhamon","id":5134584,"avatar_url":"https://avatars.githubusercontent.com/u/5134584?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewhamon","html_url":"https://github.com/andrewhamon","followers_url":"https://api.github.com/users/andrewhamon/followers","following_url":"https://api.github.com/users/andrewhamon/following{/other_user}","gists_url":"https://api.github.com/users/andrewhamon/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewhamon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewhamon/subscriptions","organizations_url":"https://api.github.com/users/andrewhamon/orgs","repos_url":"https://api.github.com/users/andrewhamon/repos","events_url":"https://api.github.com/users/andrewhamon/events{/privacy}","received_events_url":"https://api.github.com/users/andrewhamon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-28T21:25:09Z","updated_at":"2015-02-28T21:25:09Z","closed_at":null,"body":"Currently, a malicious user could subscribe to /** and receive all messages posted to faye. Although sensitive data isn't transmitted over faye (like user tokens or party coordinates). This would allow a malicious user to, over time, create a rough idea of our database (what tracks belong to which parties, list of party slugs, user id's of those active in particular parties, etc).\r\n\r\nNone of this is really personally identifiable information, but the goal was that a \"private\" parties url/slug would be undiscoverable.\r\n\r\nThere is an easy fix, which would be to disallow any faye subscriptions that have a wildcard using a simple faye extension."}}