GitHub PushEvent at 2014-01-16 06:31:44
Repository: ember.js
Actor: pangratz
Payload: {"shas":[["d9977d62b26534555c0708acde0e7ae029e6d8ea","4737d94bfb8b7940843864fc531cf5f068ebec04@me.com","[SECURITY CVE-2014-0014] Ensure {{group}} helper escapes properly.\n\nThis vulnerability has been assigned the CVE identifier CVE-2014-0014.\n\nIn general, Ember.js escapes or strips any user-supplied content before\ninserting it in strings that will be sent to innerHTML.  However, we\nhave identified a vulnerability that could lead to unescaped content being\ninserted into the innerHTML string without being sanitized.\n\nWhen using the `{{group}}` helper, user supplied content in the template\nwas not being sanitized. Though the vulnerability exists in Ember.js proper,\nit is only exposed via the use of an experimental plugin.\n\nIn applications that use the `{{group}}` helper, a specially-crafted\npayload could execute arbitrary JavaScript in the context of the current\ndomain (\"XSS\").\n\nThis vulnerability was reported to us by Edward Faulkner of CleriCare.\nMany thanks for working with us on the patches and advisory.","Robert Jackson",true],["198d571e6e5202ebd8531d92e5316cece3392a61","4737d94bfb8b7940843864fc531cf5f068ebec04@me.com","[SECURITY CVE-2014-0013] Ensure primitive value contexts are escaped.\n\nThis vulnerability has been assigned the CVE identifier CVE-2014-0013.\n\nIn general, Ember.js escapes or strips any user-supplied content before\ninserting it in strings that will be sent to innerHTML.  However, we have\nidentified a vulnerability that could lead to unescaped content being inserted\ninto the innerHTML string without being sanitized.\n\nWhen a primitive value is used as the Handlebars context, that value is not\nproperly escaped.  An example of this would be using the `{{each}}` helper to\niterate over an array of user-supplied strings and using `{{this}}` inside the\nblock to display each string.\n\nIn applications that contain templates whose context is a primitive value and\nuse the `{{this}}` keyword to display that value, a specially-crafted payload\ncould execute arbitrary JavaScript in the context of the current domain\n(\"XSS\").\n\nThis vulnerability was discovered by Robert Jackson of DockYard. Many\nthanks for working with us on the patches and advisory.","Robert Jackson",true],["3e02382f25cb3cc3c8e8ce17aa23dd0e21e63919","4737d94bfb8b7940843864fc531cf5f068ebec04@me.com","Refactor sanitization into reusable function.","Robert Jackson",true],["e34bf4b17175af37c47219d0a93d21ecfc4bfda5","4737d94bfb8b7940843864fc531cf5f068ebec04@me.com","Update CHANGELOG.","Robert Jackson",true],["543dcf910913bebd2b5963593d536573728fc4f1","4737d94bfb8b7940843864fc531cf5f068ebec04@me.com","Add missing entries to CHANGELOG.","Robert Jackson",true],["34d8830064d1ffc731eeb80fdabd25b82b69500e","9e825ceef99e05cb5da1d8966860f0752cbb7f40@gmail.com","Remove unused variable","Michael Jackson",true],["9fcdc682fd2360484e9f9b29ffd64397dbe8115b","0b40b374491a9d33ce3192c35cb80116802ee83a@gmail.com","Merge pull request #4153 from mjijackson/remove-unused-var\n\nRemove unused variable","Stefan Penner",true],["62076a4bc8c2cc257336331289443b9dbd5cb850","4737d94bfb8b7940843864fc531cf5f068ebec04@me.com","Add missing links to FEATURES.md.","Robert Jackson",true],["78101ffff8f3718f10bffb1540d2bae6a872fda3","4737d94bfb8b7940843864fc531cf5f068ebec04@me.com","Add composable-computed-properties to FEATURES.md.","Robert Jackson",true],["efafb6cdb34d82a6bb65ad21179065d8c06b3a8c","4737d94bfb8b7940843864fc531cf5f068ebec04@me.com","Add link to string-parameterize feature.","Robert Jackson",true]],"size":10,"ref":"refs/heads/master","head":"efafb6cdb34d82a6bb65ad21179065d8c06b3a8c"}