GitHub PullRequestReviewCommentEvent at 2014-08-18 00:03:32
Repository: goldenconversations
Actor: psybuzz
Payload: {"action":"created","comment":{"url":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/comments/16333424","id":16333424,"diff_hunk":"@@ -61,4 +62,20 @@ exports.denullify = function (list){\n \t}\n \n \treturn cleanList;\n-}\n\\ No newline at end of file\n+}\n+\n+/**\n+ * Sanitizes all fields within the property of an object using the validator node module.\n+ *\n+ * e.g. Utils.escape(req.body)\t\t// req.body.id, req.body.username, ... are all escaped.\n+ *\n+ * BEFORE - req.body.username === \"Mr. Dangerous <script>!\";\n+ * AFTER - req.body.username === \"Mr.%20Dangerous%20%3Cscript%3E!\";\n+ */\n+exports.escape = function (dirtyObj){\n+\tfor (prop in dirtyObj){\n+\t\tif (dirtyObj.hasOwnProperty(prop)){","path":"utils.js","position":37,"original_position":37,"commit_id":"abad91db90a3325e3fa127f7690f2a754fda189e","original_commit_id":"abad91db90a3325e3fa127f7690f2a754fda189e","user":{"login":"psybuzz","id":2322480,"avatar_url":"https://avatars.githubusercontent.com/u/2322480?v=2","gravatar_id":"b29f5c8547f8399d35cbe234a25a4b33","url":"https://api.github.com/users/psybuzz","html_url":"https://github.com/psybuzz","followers_url":"https://api.github.com/users/psybuzz/followers","following_url":"https://api.github.com/users/psybuzz/following{/other_user}","gists_url":"https://api.github.com/users/psybuzz/gists{/gist_id}","starred_url":"https://api.github.com/users/psybuzz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/psybuzz/subscriptions","organizations_url":"https://api.github.com/users/psybuzz/orgs","repos_url":"https://api.github.com/users/psybuzz/repos","events_url":"https://api.github.com/users/psybuzz/events{/privacy}","received_events_url":"https://api.github.com/users/psybuzz/received_events","type":"User","site_admin":false},"body":"Yeah, pretty much.  You know, now that I'm reviewing this...it does feel kinda unsafe to just sanitize all the properties of the body, or query, or whatever...I did not actually take the time to look at what other properties they have.  Maybe there's some odd stuff like HTTP headers that actually requires the '<' or '>' special characters.\r\n\r\nIn light of this, perhaps it'd be much safer to change the function to take a specific list of properties to sanitize.","created_at":"2014-08-18T00:03:32Z","updated_at":"2014-08-18T00:03:32Z","html_url":"https://github.com/psybuzz/goldenconversations/pull/17#discussion_r16333424","pull_request_url":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/17","_links":{"self":{"href":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/comments/16333424"},"html":{"href":"https://github.com/psybuzz/goldenconversations/pull/17#discussion_r16333424"},"pull_request":{"href":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/17"}}},"pull_request":{"url":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/17","id":19874252,"html_url":"https://github.com/psybuzz/goldenconversations/pull/17","diff_url":"https://github.com/psybuzz/goldenconversations/pull/17.diff","patch_url":"https://github.com/psybuzz/goldenconversations/pull/17.patch","issue_url":"https://api.github.com/repos/psybuzz/goldenconversations/issues/17","number":17,"state":"open","locked":false,"title":"Escape HTML entities","user":{"login":"psybuzz","id":2322480,"avatar_url":"https://avatars.githubusercontent.com/u/2322480?v=2","gravatar_id":"b29f5c8547f8399d35cbe234a25a4b33","url":"https://api.github.com/users/psybuzz","html_url":"https://github.com/psybuzz","followers_url":"https://api.github.com/users/psybuzz/followers","following_url":"https://api.github.com/users/psybuzz/following{/other_user}","gists_url":"https://api.github.com/users/psybuzz/gists{/gist_id}","starred_url":"https://api.github.com/users/psybuzz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/psybuzz/subscriptions","organizations_url":"https://api.github.com/users/psybuzz/orgs","repos_url":"https://api.github.com/users/psybuzz/repos","events_url":"https://api.github.com/users/psybuzz/events{/privacy}","received_events_url":"https://api.github.com/users/psybuzz/received_events","type":"User","site_admin":false},"body":"This PR addresses the security of saved content.  When users, conversations, posts, groups are created or saved, we currently don't escape special characters.    With posts, especially, this can cause unwanted behavior.  For example, posting:\r\n\r\n`Be the change you <b>want</b> to see...` would appear as: 'Be the change you **want** to see...'.\r\n\r\nIn this case, bolding letters is pretty benign.  But what if some user posted:\r\n`Be the change you want to see. <script>window.location='google.com'</script>` ?\r\n\r\nThis would effectively redirect your browser to google.com whenever you loaded the comment.  In order to prevent things like arbitrary script tags from being executed, we can replace things like `<` and `>` with their HTML entities.\r\n\r\nThis PR adds an .escape() utility method which gets called whenever something is created or saved.  In addition, the client side code has been updated to use .innerText in addition to jQuery's .append(), as the latter will add the provided string as HTML.","created_at":"2014-08-16T00:18:05Z","updated_at":"2014-08-18T00:03:32Z","closed_at":null,"merged_at":null,"merge_commit_sha":"dd614b4906aa03c4b5310ebfe653a7e94dd24ffb","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/17/commits","review_comments_url":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/17/comments","review_comment_url":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/comments/{number}","comments_url":"https://api.github.com/repos/psybuzz/goldenconversations/issues/17/comments","statuses_url":"https://api.github.com/repos/psybuzz/goldenconversations/statuses/abad91db90a3325e3fa127f7690f2a754fda189e","head":{"label":"psybuzz:the-great-escape","ref":"the-great-escape","sha":"abad91db90a3325e3fa127f7690f2a754fda189e","user":{"login":"psybuzz","id":2322480,"avatar_url":"https://avatars.githubusercontent.com/u/2322480?v=2","gravatar_id":"b29f5c8547f8399d35cbe234a25a4b33","url":"https://api.github.com/users/psybuzz","html_url":"https://github.com/psybuzz","followers_url":"https://api.github.com/users/psybuzz/followers","following_url":"https://api.github.com/users/psybuzz/following{/other_user}","gists_url":"https://api.github.com/users/psybuzz/gists{/gist_id}","starred_url":"https://api.github.com/users/psybuzz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/psybuzz/subscriptions","organizations_url":"https://api.github.com/users/psybuzz/orgs","repos_url":"https://api.github.com/users/psybuzz/repos","events_url":"https://api.github.com/users/psybuzz/events{/privacy}","received_events_url":"https://api.github.com/users/psybuzz/received_events","type":"User","site_admin":false},"repo":{"id":21082960,"name":"goldenconversations","full_name":"psybuzz/goldenconversations","owner":{"login":"psybuzz","id":2322480,"avatar_url":"https://avatars.githubusercontent.com/u/2322480?v=2","gravatar_id":"b29f5c8547f8399d35cbe234a25a4b33","url":"https://api.github.com/users/psybuzz","html_url":"https://github.com/psybuzz","followers_url":"https://api.github.com/users/psybuzz/followers","following_url":"https://api.github.com/users/psybuzz/following{/other_user}","gists_url":"https://api.github.com/users/psybuzz/gists{/gist_id}","starred_url":"https://api.github.com/users/psybuzz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/psybuzz/subscriptions","organizations_url":"https://api.github.com/users/psybuzz/orgs","repos_url":"https://api.github.com/users/psybuzz/repos","events_url":"https://api.github.com/users/psybuzz/events{/privacy}","received_events_url":"https://api.github.com/users/psybuzz/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/psybuzz/goldenconversations","description":"","fork":false,"url":"https://api.github.com/repos/psybuzz/goldenconversations","forks_url":"https://api.github.com/repos/psybuzz/goldenconversations/forks","keys_url":"https://api.github.com/repos/psybuzz/goldenconversations/keys{/key_id}","collaborators_url":"https://api.github.com/repos/psybuzz/goldenconversations/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/psybuzz/goldenconversations/teams","hooks_url":"https://api.github.com/repos/psybuzz/goldenconversations/hooks","issue_events_url":"https://api.github.com/repos/psybuzz/goldenconversations/issues/events{/number}","events_url":"https://api.github.com/repos/psybuzz/goldenconversations/events","assignees_url":"https://api.github.com/repos/psybuzz/goldenconversations/assignees{/user}","branches_url":"https://api.github.com/repos/psybuzz/goldenconversations/branches{/branch}","tags_url":"https://api.github.com/repos/psybuzz/goldenconversations/tags","blobs_url":"https://api.github.com/repos/psybuzz/goldenconversations/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/psybuzz/goldenconversations/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/psybuzz/goldenconversations/git/refs{/sha}","trees_url":"https://api.github.com/repos/psybuzz/goldenconversations/git/trees{/sha}","statuses_url":"https://api.github.com/repos/psybuzz/goldenconversations/statuses/{sha}","languages_url":"https://api.github.com/repos/psybuzz/goldenconversations/languages","stargazers_url":"https://api.github.com/repos/psybuzz/goldenconversations/stargazers","contributors_url":"https://api.github.com/repos/psybuzz/goldenconversations/contributors","subscribers_url":"https://api.github.com/repos/psybuzz/goldenconversations/subscribers","subscription_url":"https://api.github.com/repos/psybuzz/goldenconversations/subscription","commits_url":"https://api.github.com/repos/psybuzz/goldenconversations/commits{/sha}","git_commits_url":"https://api.github.com/repos/psybuzz/goldenconversations/git/commits{/sha}","comments_url":"https://api.github.com/repos/psybuzz/goldenconversations/comments{/number}","issue_comment_url":"https://api.github.com/repos/psybuzz/goldenconversations/issues/comments/{number}","contents_url":"https://api.github.com/repos/psybuzz/goldenconversations/contents/{+path}","compare_url":"https://api.github.com/repos/psybuzz/goldenconversations/compare/{base}...{head}","merges_url":"https://api.github.com/repos/psybuzz/goldenconversations/merges","archive_url":"https://api.github.com/repos/psybuzz/goldenconversations/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/psybuzz/goldenconversations/downloads","issues_url":"https://api.github.com/repos/psybuzz/goldenconversations/issues{/number}","pulls_url":"https://api.github.com/repos/psybuzz/goldenconversations/pulls{/number}","milestones_url":"https://api.github.com/repos/psybuzz/goldenconversations/milestones{/number}","notifications_url":"https://api.github.com/repos/psybuzz/goldenconversations/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/psybuzz/goldenconversations/labels{/name}","releases_url":"https://api.github.com/repos/psybuzz/goldenconversations/releases{/id}","created_at":"2014-06-22T01:37:12Z","updated_at":"2014-08-14T05:25:11Z","pushed_at":"2014-08-17T22:30:22Z","git_url":"git://github.com/psybuzz/goldenconversations.git","ssh_url":"git@github.com:psybuzz/goldenconversations.git","clone_url":"https://github.com/psybuzz/goldenconversations.git","svn_url":"https://github.com/psybuzz/goldenconversations","homepage":"","size":4520,"stargazers_count":1,"watchers_count":1,"language":"CSS","has_issues":true,"has_downloads":true,"has_wiki":true,"forks_count":0,"mirror_url":null,"open_issues_count":3,"forks":0,"open_issues":3,"watchers":1,"default_branch":"master"}},"base":{"label":"psybuzz:master","ref":"master","sha":"a2e9ef7f5d667f7188b2ee9064a6eab619508123","user":{"login":"psybuzz","id":2322480,"avatar_url":"https://avatars.githubusercontent.com/u/2322480?v=2","gravatar_id":"b29f5c8547f8399d35cbe234a25a4b33","url":"https://api.github.com/users/psybuzz","html_url":"https://github.com/psybuzz","followers_url":"https://api.github.com/users/psybuzz/followers","following_url":"https://api.github.com/users/psybuzz/following{/other_user}","gists_url":"https://api.github.com/users/psybuzz/gists{/gist_id}","starred_url":"https://api.github.com/users/psybuzz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/psybuzz/subscriptions","organizations_url":"https://api.github.com/users/psybuzz/orgs","repos_url":"https://api.github.com/users/psybuzz/repos","events_url":"https://api.github.com/users/psybuzz/events{/privacy}","received_events_url":"https://api.github.com/users/psybuzz/received_events","type":"User","site_admin":false},"repo":{"id":21082960,"name":"goldenconversations","full_name":"psybuzz/goldenconversations","owner":{"login":"psybuzz","id":2322480,"avatar_url":"https://avatars.githubusercontent.com/u/2322480?v=2","gravatar_id":"b29f5c8547f8399d35cbe234a25a4b33","url":"https://api.github.com/users/psybuzz","html_url":"https://github.com/psybuzz","followers_url":"https://api.github.com/users/psybuzz/followers","following_url":"https://api.github.com/users/psybuzz/following{/other_user}","gists_url":"https://api.github.com/users/psybuzz/gists{/gist_id}","starred_url":"https://api.github.com/users/psybuzz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/psybuzz/subscriptions","organizations_url":"https://api.github.com/users/psybuzz/orgs","repos_url":"https://api.github.com/users/psybuzz/repos","events_url":"https://api.github.com/users/psybuzz/events{/privacy}","received_events_url":"https://api.github.com/users/psybuzz/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/psybuzz/goldenconversations","description":"","fork":false,"url":"https://api.github.com/repos/psybuzz/goldenconversations","forks_url":"https://api.github.com/repos/psybuzz/goldenconversations/forks","keys_url":"https://api.github.com/repos/psybuzz/goldenconversations/keys{/key_id}","collaborators_url":"https://api.github.com/repos/psybuzz/goldenconversations/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/psybuzz/goldenconversations/teams","hooks_url":"https://api.github.com/repos/psybuzz/goldenconversations/hooks","issue_events_url":"https://api.github.com/repos/psybuzz/goldenconversations/issues/events{/number}","events_url":"https://api.github.com/repos/psybuzz/goldenconversations/events","assignees_url":"https://api.github.com/repos/psybuzz/goldenconversations/assignees{/user}","branches_url":"https://api.github.com/repos/psybuzz/goldenconversations/branches{/branch}","tags_url":"https://api.github.com/repos/psybuzz/goldenconversations/tags","blobs_url":"https://api.github.com/repos/psybuzz/goldenconversations/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/psybuzz/goldenconversations/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/psybuzz/goldenconversations/git/refs{/sha}","trees_url":"https://api.github.com/repos/psybuzz/goldenconversations/git/trees{/sha}","statuses_url":"https://api.github.com/repos/psybuzz/goldenconversations/statuses/{sha}","languages_url":"https://api.github.com/repos/psybuzz/goldenconversations/languages","stargazers_url":"https://api.github.com/repos/psybuzz/goldenconversations/stargazers","contributors_url":"https://api.github.com/repos/psybuzz/goldenconversations/contributors","subscribers_url":"https://api.github.com/repos/psybuzz/goldenconversations/subscribers","subscription_url":"https://api.github.com/repos/psybuzz/goldenconversations/subscription","commits_url":"https://api.github.com/repos/psybuzz/goldenconversations/commits{/sha}","git_commits_url":"https://api.github.com/repos/psybuzz/goldenconversations/git/commits{/sha}","comments_url":"https://api.github.com/repos/psybuzz/goldenconversations/comments{/number}","issue_comment_url":"https://api.github.com/repos/psybuzz/goldenconversations/issues/comments/{number}","contents_url":"https://api.github.com/repos/psybuzz/goldenconversations/contents/{+path}","compare_url":"https://api.github.com/repos/psybuzz/goldenconversations/compare/{base}...{head}","merges_url":"https://api.github.com/repos/psybuzz/goldenconversations/merges","archive_url":"https://api.github.com/repos/psybuzz/goldenconversations/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/psybuzz/goldenconversations/downloads","issues_url":"https://api.github.com/repos/psybuzz/goldenconversations/issues{/number}","pulls_url":"https://api.github.com/repos/psybuzz/goldenconversations/pulls{/number}","milestones_url":"https://api.github.com/repos/psybuzz/goldenconversations/milestones{/number}","notifications_url":"https://api.github.com/repos/psybuzz/goldenconversations/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/psybuzz/goldenconversations/labels{/name}","releases_url":"https://api.github.com/repos/psybuzz/goldenconversations/releases{/id}","created_at":"2014-06-22T01:37:12Z","updated_at":"2014-08-14T05:25:11Z","pushed_at":"2014-08-17T22:30:22Z","git_url":"git://github.com/psybuzz/goldenconversations.git","ssh_url":"git@github.com:psybuzz/goldenconversations.git","clone_url":"https://github.com/psybuzz/goldenconversations.git","svn_url":"https://github.com/psybuzz/goldenconversations","homepage":"","size":4520,"stargazers_count":1,"watchers_count":1,"language":"CSS","has_issues":true,"has_downloads":true,"has_wiki":true,"forks_count":0,"mirror_url":null,"open_issues_count":3,"forks":0,"open_issues":3,"watchers":1,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/17"},"html":{"href":"https://github.com/psybuzz/goldenconversations/pull/17"},"issue":{"href":"https://api.github.com/repos/psybuzz/goldenconversations/issues/17"},"comments":{"href":"https://api.github.com/repos/psybuzz/goldenconversations/issues/17/comments"},"review_comments":{"href":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/17/comments"},"review_comment":{"href":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/psybuzz/goldenconversations/pulls/17/commits"},"statuses":{"href":"https://api.github.com/repos/psybuzz/goldenconversations/statuses/abad91db90a3325e3fa127f7690f2a754fda189e"}}}}