{"issue":{"pull_request":{"diff_url":null,"html_url":null,"patch_url":null},"state":"closed","user":{"avatar_url":"https://secure.gravatar.com/avatar/c50af17ff68eb6199ddf2b2e2144ce8c?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"c50af17ff68eb6199ddf2b2e2144ce8c","url":"https://api.github.com/users/vizjerai","login":"vizjerai","id":67556},"milestone":null,"labels":[],"updated_at":"2011-11-04T02:02:53Z","assignee":null,"comments":1,"closed_at":"2011-11-04T02:02:53Z","url":"https://api.github.com/repos/Srirangan/notifer.js/issues/1","body":"Running this will show an alert for the title and message and not correctly escape the text.\r\n\r\n```JavaScript\r\nNotifier.info('<script>alert(\"title\");</script>', '<script>alert(\"message\");</script>');\r\n```\r\n\r\nThe icon could do the same if the string was crafted well enough.\r\n\r\nBecause of the requirement for jQuery you can use it to create the objects and let it escape the text for you with the .text() method. As well as .attr()\r\n\r\n```JavaScript\r\n$('<div></div>').text('<script>alert(\"title\");</script>');\r\n```","html_url":"https://github.com/Srirangan/notifer.js/issues/1","number":1,"title":"Vulnerable To Cross Site Scripting (XSS)","id":2136854,"created_at":"2011-11-03T19:51:24Z"},"action":"closed"}