Add Loofah XSS vulnerability

[brynary]

https://groups.google.com/forum/?fromgroups=#!searchin/nokogiri-talk/vulnerability/nokogiri-talk/PZK-KcxC_gE/EmB7DFYGGp8J

[tarcieri]

This doesn't have a "cve:" entry... is that kosher?

[mveytsman]

No cve Id was assigned for the vuln. The rspec tests now require either a cve or a osvdb id to be present. I don't think we'll encounter advisories that aren't in one of the two places.

On 2013-04-01, at 6:59 PM, Tony Arcieri notifications@github.com wrote:

This doesn't have a "cve:" entry... is that kosher?

—
Reply to this email directly or view it on GitHub.

[tarcieri]

I've been using CVEs as the canonical ID for http://rubysec.github.com ... is that not going to work?

[mveytsman]

Yeah that's a problem, right now the canonical ID is one of CVE, OSVDB, which is not ideal. let's switch this discussion to #35