{"action":"opened","number":151,"pull_request":{"url":"https://api.github.com/repos/jfhbrook/node-ecstatic/pulls/151","id":43574951,"html_url":"https://github.com/jfhbrook/node-ecstatic/pull/151","diff_url":"https://github.com/jfhbrook/node-ecstatic/pull/151.diff","patch_url":"https://github.com/jfhbrook/node-ecstatic/pull/151.patch","issue_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/issues/151","number":151,"state":"open","locked":false,"title":"Potential XSS mitigations and encoding corrections","user":{"login":"jre-g","id":9858748,"avatar_url":"https://avatars.githubusercontent.com/u/9858748?v=3","gravatar_id":"","url":"https://api.github.com/users/jre-g","html_url":"https://github.com/jre-g","followers_url":"https://api.github.com/users/jre-g/followers","following_url":"https://api.github.com/users/jre-g/following{/other_user}","gists_url":"https://api.github.com/users/jre-g/gists{/gist_id}","starred_url":"https://api.github.com/users/jre-g/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jre-g/subscriptions","organizations_url":"https://api.github.com/users/jre-g/orgs","repos_url":"https://api.github.com/users/jre-g/repos","events_url":"https://api.github.com/users/jre-g/events{/privacy}","received_events_url":"https://api.github.com/users/jre-g/received_events","type":"User","site_admin":false},"body":"The change I submitted in #142 was adequate to prevent XSS in Firefox, but potentially not in all browsers. Previous versions of Internet Explorer have aggressively sniffed `text/plain` content as `text/html` despite the header, and it may be possible to provoke this behaviour in current versions if compatibility modes are enabled. Bugs have also resulted in this behaviour in other browsers in some contexts, as recently as iOS 6 Safari. I'm not certain whether it's possible to trigger this for these specific error messages (I don't have a proof of concept), but in the interest of taking a conservative approach to security, I suggest replacing the `text/plain` responses with unencoded bodies with `text/html` responses with encoded bodies.\r\n\r\nThis PR also corrects two other locations where data was being outputted without being encoded. There are *probably* not dangerous, but it would be more correct to encode them and avoid creating non-validating documents.\r\n\r\nPlease see [here](https://travis-ci.org/jre-g/node-ecstatic/jobs/77593226) for a Travis build with the test changes but without the other changes, demonstrating that regressions cause the tests to fail.\r\n\r\n---\r\n\r\nEncoding current directory name in directory listings. HTML in directory names (unlikely but possible) could previously have been rendered in the page.\r\n\r\nEncoding query strings in subdirectory links in directory listings. It is unclear if the query string values could actually have been rendered in any cases, but the unencoded values could produce inconsequentially incorrect links (e.g. `/?&gt;` would produce subdirectory links like `/dir/>`) and cause HTML validation to fail.\r\n\r\nReplacing text/plain responses messages for 400 and 500 errors with text/html response pages. This should not be neccessary in theory, but older versions of some browsers including Internet Explorer (and possibly newer versions in certain contexts) sometimes render text/plain content as text/html for backwards compatibility with poorly-configured servers, even if `X-Content-Type-Options: nosniff` is specified. Since the errors messages in these handlers could potentially include content reflected from the requests, the most conservative and safe approach is to use an HTML response with the error messages encoded.\r\n\r\nAlso updates LICENSE.txt to include the current year and some additional contributors.","created_at":"2015-08-27T22:34:24Z","updated_at":"2015-08-27T22:34:24Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/pulls/151/commits","review_comments_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/pulls/151/comments","review_comment_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/pulls/comments{/number}","comments_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/issues/151/comments","statuses_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/statuses/4ba99b741b9d703e8a76fb6629668614826ac135","head":{"label":"jre-g:xss-mitigations","ref":"xss-mitigations","sha":"4ba99b741b9d703e8a76fb6629668614826ac135","user":{"login":"jre-g","id":9858748,"avatar_url":"https://avatars.githubusercontent.com/u/9858748?v=3","gravatar_id":"","url":"https://api.github.com/users/jre-g","html_url":"https://github.com/jre-g","followers_url":"https://api.github.com/users/jre-g/followers","following_url":"https://api.github.com/users/jre-g/following{/other_user}","gists_url":"https://api.github.com/users/jre-g/gists{/gist_id}","starred_url":"https://api.github.com/users/jre-g/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jre-g/subscriptions","organizations_url":"https://api.github.com/users/jre-g/orgs","repos_url":"https://api.github.com/users/jre-g/repos","events_url":"https://api.github.com/users/jre-g/events{/privacy}","received_events_url":"https://api.github.com/users/jre-g/received_events","type":"User","site_admin":false},"repo":{"id":34867091,"name":"node-ecstatic","full_name":"jre-g/node-ecstatic","owner":{"login":"jre-g","id":9858748,"avatar_url":"https://avatars.githubusercontent.com/u/9858748?v=3","gravatar_id":"","url":"https://api.github.com/users/jre-g","html_url":"https://github.com/jre-g","followers_url":"https://api.github.com/users/jre-g/followers","following_url":"https://api.github.com/users/jre-g/following{/other_user}","gists_url":"https://api.github.com/users/jre-g/gists{/gist_id}","starred_url":"https://api.github.com/users/jre-g/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jre-g/subscriptions","organizations_url":"https://api.github.com/users/jre-g/orgs","repos_url":"https://api.github.com/users/jre-g/repos","events_url":"https://api.github.com/users/jre-g/events{/privacy}","received_events_url":"https://api.github.com/users/jre-g/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jre-g/node-ecstatic","description":"A simple static file server middleware that works with core http, Express and Flatiron","fork":true,"url":"https://api.github.com/repos/jre-g/node-ecstatic","forks_url":"https://api.github.com/repos/jre-g/node-ecstatic/forks","keys_url":"https://api.github.com/repos/jre-g/node-ecstatic/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jre-g/node-ecstatic/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jre-g/node-ecstatic/teams","hooks_url":"https://api.github.com/repos/jre-g/node-ecstatic/hooks","issue_events_url":"https://api.github.com/repos/jre-g/node-ecstatic/issues/events{/number}","events_url":"https://api.github.com/repos/jre-g/node-ecstatic/events","assignees_url":"https://api.github.com/repos/jre-g/node-ecstatic/assignees{/user}","branches_url":"https://api.github.com/repos/jre-g/node-ecstatic/branches{/branch}","tags_url":"https://api.github.com/repos/jre-g/node-ecstatic/tags","blobs_url":"https://api.github.com/repos/jre-g/node-ecstatic/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jre-g/node-ecstatic/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jre-g/node-ecstatic/git/refs{/sha}","trees_url":"https://api.github.com/repos/jre-g/node-ecstatic/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jre-g/node-ecstatic/statuses/{sha}","languages_url":"https://api.github.com/repos/jre-g/node-ecstatic/languages","stargazers_url":"https://api.github.com/repos/jre-g/node-ecstatic/stargazers","contributors_url":"https://api.github.com/repos/jre-g/node-ecstatic/contributors","subscribers_url":"https://api.github.com/repos/jre-g/node-ecstatic/subscribers","subscription_url":"https://api.github.com/repos/jre-g/node-ecstatic/subscription","commits_url":"https://api.github.com/repos/jre-g/node-ecstatic/commits{/sha}","git_commits_url":"https://api.github.com/repos/jre-g/node-ecstatic/git/commits{/sha}","comments_url":"https://api.github.com/repos/jre-g/node-ecstatic/comments{/number}","issue_comment_url":"https://api.github.com/repos/jre-g/node-ecstatic/issues/comments{/number}","contents_url":"https://api.github.com/repos/jre-g/node-ecstatic/contents/{+path}","compare_url":"https://api.github.com/repos/jre-g/node-ecstatic/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jre-g/node-ecstatic/merges","archive_url":"https://api.github.com/repos/jre-g/node-ecstatic/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jre-g/node-ecstatic/downloads","issues_url":"https://api.github.com/repos/jre-g/node-ecstatic/issues{/number}","pulls_url":"https://api.github.com/repos/jre-g/node-ecstatic/pulls{/number}","milestones_url":"https://api.github.com/repos/jre-g/node-ecstatic/milestones{/number}","notifications_url":"https://api.github.com/repos/jre-g/node-ecstatic/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jre-g/node-ecstatic/labels{/name}","releases_url":"https://api.github.com/repos/jre-g/node-ecstatic/releases{/id}","created_at":"2015-04-30T17:22:11Z","updated_at":"2015-08-27T21:46:57Z","pushed_at":"2015-08-27T22:06:43Z","git_url":"git://github.com/jre-g/node-ecstatic.git","ssh_url":"git@github.com:jre-g/node-ecstatic.git","clone_url":"https://github.com/jre-g/node-ecstatic.git","svn_url":"https://github.com/jre-g/node-ecstatic","homepage":"https://github.com/jfhbrook/node-ecstatic","size":543,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"jfhbrook:master","ref":"master","sha":"1bb2dcda03d4a6055761819bda621fda606bb0d5","user":{"login":"jfhbrook","id":57536,"avatar_url":"https://avatars.githubusercontent.com/u/57536?v=3","gravatar_id":"","url":"https://api.github.com/users/jfhbrook","html_url":"https://github.com/jfhbrook","followers_url":"https://api.github.com/users/jfhbrook/followers","following_url":"https://api.github.com/users/jfhbrook/following{/other_user}","gists_url":"https://api.github.com/users/jfhbrook/gists{/gist_id}","starred_url":"https://api.github.com/users/jfhbrook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfhbrook/subscriptions","organizations_url":"https://api.github.com/users/jfhbrook/orgs","repos_url":"https://api.github.com/users/jfhbrook/repos","events_url":"https://api.github.com/users/jfhbrook/events{/privacy}","received_events_url":"https://api.github.com/users/jfhbrook/received_events","type":"User","site_admin":false},"repo":{"id":2791093,"name":"node-ecstatic","full_name":"jfhbrook/node-ecstatic","owner":{"login":"jfhbrook","id":57536,"avatar_url":"https://avatars.githubusercontent.com/u/57536?v=3","gravatar_id":"","url":"https://api.github.com/users/jfhbrook","html_url":"https://github.com/jfhbrook","followers_url":"https://api.github.com/users/jfhbrook/followers","following_url":"https://api.github.com/users/jfhbrook/following{/other_user}","gists_url":"https://api.github.com/users/jfhbrook/gists{/gist_id}","starred_url":"https://api.github.com/users/jfhbrook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfhbrook/subscriptions","organizations_url":"https://api.github.com/users/jfhbrook/orgs","repos_url":"https://api.github.com/users/jfhbrook/repos","events_url":"https://api.github.com/users/jfhbrook/events{/privacy}","received_events_url":"https://api.github.com/users/jfhbrook/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jfhbrook/node-ecstatic","description":"A simple static file server middleware that works with core http, Express and Flatiron","fork":false,"url":"https://api.github.com/repos/jfhbrook/node-ecstatic","forks_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/forks","keys_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/teams","hooks_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/hooks","issue_events_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/issues/events{/number}","events_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/events","assignees_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/assignees{/user}","branches_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/branches{/branch}","tags_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/tags","blobs_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/git/refs{/sha}","trees_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/statuses/{sha}","languages_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/languages","stargazers_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/stargazers","contributors_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/contributors","subscribers_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/subscribers","subscription_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/subscription","commits_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/commits{/sha}","git_commits_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/git/commits{/sha}","comments_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/comments{/number}","issue_comment_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/issues/comments{/number}","contents_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/contents/{+path}","compare_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/merges","archive_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/downloads","issues_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/issues{/number}","pulls_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/pulls{/number}","milestones_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/milestones{/number}","notifications_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/labels{/name}","releases_url":"https://api.github.com/repos/jfhbrook/node-ecstatic/releases{/id}","created_at":"2011-11-16T21:17:39Z","updated_at":"2015-08-26T01:09:02Z","pushed_at":"2015-08-26T23:54:04Z","git_url":"git://github.com/jfhbrook/node-ecstatic.git","ssh_url":"git@github.com:jfhbrook/node-ecstatic.git","clone_url":"https://github.com/jfhbrook/node-ecstatic.git","svn_url":"https://github.com/jfhbrook/node-ecstatic","homepage":"https://github.com/jfhbrook/node-ecstatic","size":1346,"stargazers_count":339,"watchers_count":339,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":64,"mirror_url":null,"open_issues_count":15,"forks":64,"open_issues":15,"watchers":339,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/jfhbrook/node-ecstatic/pulls/151"},"html":{"href":"https://github.com/jfhbrook/node-ecstatic/pull/151"},"issue":{"href":"https://api.github.com/repos/jfhbrook/node-ecstatic/issues/151"},"comments":{"href":"https://api.github.com/repos/jfhbrook/node-ecstatic/issues/151/comments"},"review_comments":{"href":"https://api.github.com/repos/jfhbrook/node-ecstatic/pulls/151/comments"},"review_comment":{"href":"https://api.github.com/repos/jfhbrook/node-ecstatic/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/jfhbrook/node-ecstatic/pulls/151/commits"},"statuses":{"href":"https://api.github.com/repos/jfhbrook/node-ecstatic/statuses/4ba99b741b9d703e8a76fb6629668614826ac135"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"commits":1,"additions":112,"deletions":12,"changed_files":8}}