{"issue":{"milestone":null,"user":{"id":146321,"login":"dragoonis","url":"https://api.github.com/users/dragoonis","gravatar_id":"290cdad0e6ff9caf01ca06f70cddc808","avatar_url":"https://secure.gravatar.com/avatar/290cdad0e6ff9caf01ca06f70cddc808?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"created_at":"2011-12-20T05:50:56Z","title":"Possible but not confirmed security issue with inline JS includes.","labels":[],"state":"open","updated_at":"2011-12-20T06:03:41Z","id":2609634,"closed_at":null,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"html_url":"https://github.com/ppi/skeletonapp/issues/3","body":"We can do ```$this->addJS('somefile');``` in our controller code addiing multiple files. the result is the following format.\r\n\r\n``` html\r\n<script src=\"http://www.site.com/scripts/js.php?mod=generic,somefile\"></script>\r\n```\r\n\r\nThe code parsing this is here: https://github.com/ppi/skeletonapp/blob/master/scripts/js.php\r\n\r\n``` php\r\n<?php\r\n$modules = isset($_GET['mod']) ? explode(',', str_replace('../', '', $_GET['mod'])) : array();\r\n```\r\n\r\nEven though a '.js' is appended onto the end, this doesn't rule out some kind of null-terminated string bug.\r\n\r\nPatches++ !","number":3,"url":"https://api.github.com/repos/ppi/skeletonapp/issues/3","comments":1,"assignee":null},"comment":{"user":{"id":146321,"login":"dragoonis","url":"https://api.github.com/users/dragoonis","gravatar_id":"290cdad0e6ff9caf01ca06f70cddc808","avatar_url":"https://secure.gravatar.com/avatar/290cdad0e6ff9caf01ca06f70cddc808?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"created_at":"2011-12-20T06:03:41Z","updated_at":"2011-12-20T06:03:41Z","id":3215024,"body":"Possible patch. to 1) Strip off fancy whitespace. 2) Remove starting or trailing '.' chars to rule out ../\r\n\r\n``` php\r\n<?php\r\n$str = $_GET['mod'];\r\n$str = filter_var($str, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);\r\n$str = trim($str, '.');\r\n```","url":"https://api.github.com/repos/ppi/skeletonapp/issues/comments/3215024"},"action":"created"}