{"issue":{"created_at":"2011-11-22T08:25:45Z","state":"open","updated_at":"2011-12-04T11:11:54Z","user":{"gravatar_id":"2275a4bed48c6c3090a7eeefa9e941f6","id":477137,"url":"https://api.github.com/users/xert","login":"xert","avatar_url":"https://secure.gravatar.com/avatar/2275a4bed48c6c3090a7eeefa9e941f6?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"comments":12,"body":"When issue has description containing for example\r\n\r\n```\r\n@<script>alert('xss')</script>@\r\n```\r\n\r\nthen the alert pops up after hovering mouse on issue number in backlogs.","assignee":null,"id":2315528,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"labels":[{"name":"in-progress","color":"02e10c","url":"https://api.github.com/repos/relaxdiego/redmine_backlogs/labels/in-progress"}],"number":354,"title":"XSS Vulnerability","html_url":"https://github.com/relaxdiego/redmine_backlogs/issues/354","closed_at":null,"url":"https://api.github.com/repos/relaxdiego/redmine_backlogs/issues/354","milestone":null},"action":"created","comment":{"created_at":"2011-12-04T11:11:54Z","updated_at":"2011-12-04T11:11:54Z","user":{"gravatar_id":"047813f350e12f0c20213378ce807e94","id":132108,"url":"https://api.github.com/users/friflaj","login":"friflaj","avatar_url":"https://secure.gravatar.com/avatar/047813f350e12f0c20213378ce807e94?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"body":"That is really nasty; the authors that use html() in this way clearly don't\nunderstand what it really does. They should be using clone, not\nhtml(innerhtml). The double escape I do now is a workaround with potential\nunwanted side effects, harmless but ugly, but it will close the security\nhole. Really don't know what to do with this other than to ditch qtip2. I\ncan't go scanning external libs for problems like these, certainly not\njavascript based ones.","id":3005941,"url":"https://api.github.com/repos/relaxdiego/redmine_backlogs/issues/comments/3005941"}}