GitHub PullRequestReviewCommentEvent at 2014-04-04 22:13:20
Repository: galaxy
Actor: cvan
Payload: {"comment":{"url":"https://api.github.com/repos/cvan/galaxy/pulls/comments/11316189","id":11316189,"diff_hunk":"@@ -47,15 +47,21 @@ define('media-input',\n     }\n \n     function preview(type, src, launch) {\n-        var $filePreview = $('.media-preview[data-type=\"' + type + '\"]');\n-        $filePreview.show();\n+        if (type === \"icons\") {\n+            var $filePreview = $('.media-preview[data-type=\"' + type + '\"]');\n+            $filePreview.show();\n \n-        var img = $filePreview[0];\n-        img.src = src;\n-        img.onload = function() {\n-            $filePreview.siblings('.media-size').html(\n-                this.width + 'px &times; ' + this.height + 'px').show();\n-        };\n+            var img = $filePreview[0];\n+            img.src = src;\n+            img.onload = function() {\n+                $filePreview.siblings('.media-size').html(\n+                    this.width + 'px &times; ' + this.height + 'px').show();\n+            };\n+        } else {\n+            var span = document.createElement('span');\n+            span.innerHTML = ['<img src=\"', src, '\"/>'].join('');","path":"src/media/js/media-input.js","position":24,"original_position":24,"commit_id":"910e5452a596cc2ac715aa3675580fc0813b339e","original_commit_id":"910e5452a596cc2ac715aa3675580fc0813b339e","user":{"login":"cvan","id":203725,"avatar_url":"https://avatars.githubusercontent.com/u/203725?","gravatar_id":"47de0e6948b289c9b4b4be0d6d66c0f4","url":"https://api.github.com/users/cvan","html_url":"https://github.com/cvan","followers_url":"https://api.github.com/users/cvan/followers","following_url":"https://api.github.com/users/cvan/following{/other_user}","gists_url":"https://api.github.com/users/cvan/gists{/gist_id}","starred_url":"https://api.github.com/users/cvan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cvan/subscriptions","organizations_url":"https://api.github.com/users/cvan/orgs","repos_url":"https://api.github.com/users/cvan/repos","events_url":"https://api.github.com/users/cvan/events{/privacy}","received_events_url":"https://api.github.com/users/cvan/received_events","type":"User","site_admin":false},"body":"you need to escape `src` (check `utils.js`) or you expose yourself to [XSS](http://en.wikipedia.org/wiki/Cross-site_scripting)","created_at":"2014-04-04T22:13:20Z","updated_at":"2014-04-04T22:13:20Z","html_url":"https://github.com/cvan/galaxy/pull/158#discussion_r11316189","pull_request_url":"https://api.github.com/repos/cvan/galaxy/pulls/158","_links":{"self":{"href":"https://api.github.com/repos/cvan/galaxy/pulls/comments/11316189"},"html":{"href":"https://github.com/cvan/galaxy/pull/158#discussion_r11316189"},"pull_request":{"href":"https://api.github.com/repos/cvan/galaxy/pulls/158"}}}}