{"issue":{"state":"open","created_at":"2011-11-29T10:27:51Z","updated_at":"2011-11-29T10:27:52Z","user":{"gravatar_id":"256406243346b9253f8610fb1d1e05f6","id":1215373,"url":"https://api.github.com/users/importer","avatar_url":"https://secure.gravatar.com/avatar/256406243346b9253f8610fb1d1e05f6?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"importer"},"comments":1,"body":"Szenario: Ein (Post) Parameter, soll auf einer folgenden Seite als hidden field wieder ausgegeben werden.\n\nÜbergabe des Wertes wie bare91da\"style%3d\"x%3aexpression(alert(1))\"adef49dad53 erzeugt folgende Ausgabe\n\n```\n<input type=\"hidden\" name=\"foo\" value=\"bare91da\"style=\"x:expression(alert(1))\"adef49dad53\">\n```\n\nund damit im IE einen alert-Dialog.\n\nexpression sollte daher in Input.php's xssClean berücksichtigt werden.\n\nDanke,\nFiedsch\n\n--- _Originally created by fiedsch on February 14th, 2011, at 10:25am (ID 2865)_","assignee":{"gravatar_id":"87d2e5aefadcb310f9155df28c2b3582","id":1192057,"url":"https://api.github.com/users/leofeyer","avatar_url":"https://secure.gravatar.com/avatar/87d2e5aefadcb310f9155df28c2b3582?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"leofeyer"},"id":2382823,"labels":[{"name":"Defect","color":"bd2c00","url":"https://api.github.com/repos/contao/test/labels/Defect"},{"name":"framework","color":"e6e6e6","url":"https://api.github.com/repos/contao/test/labels/framework"}],"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"number":2865,"title":"Input.php filtert nicht \"expression()\"","closed_at":null,"html_url":"https://github.com/contao/test/issues/2865","url":"https://api.github.com/repos/contao/test/issues/2865","milestone":{"state":"open","created_at":"2011-11-29T05:27:05Z","due_on":null,"closed_issues":76,"creator":{"gravatar_id":"87d2e5aefadcb310f9155df28c2b3582","id":1192057,"url":"https://api.github.com/users/leofeyer","avatar_url":"https://secure.gravatar.com/avatar/87d2e5aefadcb310f9155df28c2b3582?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"leofeyer"},"number":32,"description":"Contao 2.10.0 (minor release)","title":"2.10.0","open_issues":1,"url":"https://api.github.com/repos/contao/test/milestones/32"}},"action":"created","comment":{"created_at":"2011-11-29T10:27:52Z","updated_at":"2011-11-29T10:27:52Z","user":{"gravatar_id":"9994df352157ae1b778b792744bdbf05","id":1073273,"url":"https://api.github.com/users/aschempp","avatar_url":"https://secure.gravatar.com/avatar/9994df352157ae1b778b792744bdbf05?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"aschempp"},"body":"Das ist aus meiner Sicht nichts was mit dem Core zu tun hat. Eigentlich müssten ja nur die Anführungszeichen wieder \"escaped\" werden, wie generierst du denn das hidden field?\n\n--- _Originally created on February 14th, 2011, at 07:34pm_","id":2927583,"url":"https://api.github.com/repos/contao/test/issues/comments/2927583"}}