sanitize template option for tooltip/popover plugins#28236

Merged

XhmikosR merged 3 commits intov4-devfrom

v4-dev-jo-sanitize

Feb 13, 2019

Member

Johann-S commented Feb 11, 2019 •

edited by bardiharborow

Loading

XSS was possible in the tooltip or popover data-template, data-content and data-title attributes.

Fixes CVE-2019-8331.

Johann-S added js v4 labels

Johann-S requested a review from a team as a code owner

February 11, 2019 21:00

Johann-S force-pushed the v4-dev-jo-sanitize branch from 3b200ed to 5b074dd Compare

February 11, 2019 21:23

markhalliwell suggested changes

View reviewed changes

js/src/tooltip.js Outdated Show resolved Hide resolved

js/src/tooltip.js Outdated Show resolved Hide resolved

site/docs/4.3/components/popovers.md Outdated Show resolved Hide resolved

js/src/tools/sanitizer.js Show resolved Hide resolved

js/src/tools/sanitizer.js Outdated Show resolved Hide resolved

js/src/tools/sanitizer.js Outdated Show resolved Hide resolved

js/src/tooltip.js Outdated Show resolved Hide resolved

Member

XhmikosR commented Feb 12, 2019

@MarkCarver: you need to tone down the discussion.

Johann-S force-pushed the v4-dev-jo-sanitize branch from cb1299a to 50b9795 Compare

February 12, 2019 09:39

Member Author

Johann-S commented Feb 12, 2019 •

edited

Loading

Ok things I have to do:

Update the docs
Sanitize title and content if html is at true
Not allowing sanitize to be set by data attributes in HTML

And I think it'll be good, do not hesite @MarkCarver if you have any feedbacks, I think I heard you 👍

Johann-S force-pushed the v4-dev-jo-sanitize branch 2 times, most recently from ae35b82 to e780c0a Compare

February 12, 2019 10:55

markhalliwell reviewed

View reviewed changes

js/src/tools/sanitizer.js Outdated Show resolved Hide resolved

markhalliwell reviewed

View reviewed changes

js/src/tools/sanitizer.js Outdated Show resolved Hide resolved

markhalliwell reviewed

View reviewed changes

js/src/tooltip.js Outdated Show resolved Hide resolved

markhalliwell reviewed

View reviewed changes

site/docs/4.3/getting-started/javascript.md Outdated Show resolved Hide resolved

markhalliwell reviewed

View reviewed changes

site/docs/4.3/getting-started/javascript.md Outdated Show resolved Hide resolved

markhalliwell commented Feb 12, 2019

I think the title option still needs to be sanitized, didn't see that in the latest code changes yet.

markhalliwell commented Feb 12, 2019

Not allowing sanitize to be set by data attributes in HTML

Not allowing sanitize or whiteList to be set by data attributes in HTML

Member Author

Johann-S commented Feb 12, 2019

The title is sanitized by the same methods which sanitized content

markhalliwell commented Feb 12, 2019

Ah, you're right. Forgot that BS4 added setElementContent.

Johann-S force-pushed the v4-dev-jo-sanitize branch 3 times, most recently from 2f8ab60 to e47107e Compare

February 12, 2019 13:23

markhalliwell reviewed

View reviewed changes

site/docs/4.3/getting-started/javascript.md Outdated Show resolved Hide resolved

markhalliwell commented Feb 12, 2019

Just that tiny doc nit, but other than that I think this looks good!

Ty and amazing work!

markhalliwell reviewed

View reviewed changes

site/docs/4.3/components/popovers.md Show resolved Hide resolved

Johann-S force-pushed the v4-dev-jo-sanitize branch from cbe3a32 to 0cd53fc Compare

February 12, 2019 13:42

XhmikosR force-pushed the v4-dev-jo-sanitize branch 4 times, most recently from 231135c to 12405cc Compare

February 12, 2019 16:30

joshn-whitesource-app bot mentioned this pull request

bootstrap-3.3.7.min.js: 5 vulnerabilities (highest severity is: 6.1) Mend-JoshN-GHE-SAST/easybuggy4#26

Open

ghost mentioned this pull request

bootstrap-3.3.7.jar: 7 vulnerabilities (highest severity is: 6.4) unreachable - autoclosed rammdemocorp-mend/WebGoat#15

Closed

Kofysh mentioned this pull request

🔒 Vulnerability Report : Bootstrap Dependency Issue (CVE-2024-6531) NginxProxyManager/nginx-proxy-manager#4121

Closed

ghe-v2 bot mentioned this pull request

bootstrap-3.3.7.min.js: 6 vulnerabilities (highest severity is: 6.1) jesse-ghe-2/easybuggy#13

Open

mend-app-ghe bot mentioned this pull request

bootstrap-3.3.6.min.js: 7 vulnerabilities (highest severity is: 6.4) GHE-self-hosted/playframework#5

Open

ibm-mend-app bot mentioned this pull request

bootstrap-3.3.5.min.js: 6 vulnerabilities (highest severity is: 6.1) IBM/taxinomitis#518

Closed

This was referenced Oct 20, 2025

bootstrap-3.3.7.jar: 6 vulnerabilities (highest severity is: 5.3) [main] (unreachable) AS-Mend/WebGoat8#114

Open

bootstrap-3.3.7.min.js: 6 vulnerabilities (highest severity is: 6.4) [main] Emmanuel-Evenzur/EasyBuggy#54

Open

bootstrap-4.1.0.min.js: 4 vulnerabilities (highest severity is: 6.1) [master] Emmanuel-Evenzur/PyGoat-#77

Open

bootstrap-3.1.1.min.js: 6 vulnerabilities (highest severity is: 6.1) [main] Emmanuel-Evenzur/WebGoat_Mend_Demo#62

Closed

bootstrap-3.3.6.js: 6 vulnerabilities (highest severity is: 6.1) [release-6.0.0-pre.20221020.1rc1] Emmanuel-Evenzur/monorepo#38

Open

bootstrap-3.3.6.min.js: 6 vulnerabilities (highest severity is: 6.1) [release-6.0.0-pre.20221020.1rc1] Emmanuel-Evenzur/monorepo#50

Open

bootstrap-3.3.7.jar: 6 vulnerabilities (highest severity is: 6.1) [main] (unreachable) DimaDevPlt/MyDemoCorp#15

Open

bootstrap-3.1.1.min.js: 6 vulnerabilities (highest severity is: 6.4) [main] Mend-DevPlatform/WebGoat#8

Open

bootstrap-3.3.7.jar: 6 vulnerabilities (highest severity is: 6.1) [main] (unreachable) GarySegal-MendDemo-DevPlatform/JavaDemo#19

Open

This was referenced Oct 30, 2025

bootstrap-3.3.7.min.js: 6 vulnerabilities (highest severity is: 6.1) [master] deanshapira/easybuggy#59

Open

bootstrap-3.1.1.min.js: 6 vulnerabilities (highest severity is: 6.1) [main] deanshapira/WebGoat#33

Open

bootstrap-3.3.7.jar: 4 vulnerabilities (highest severity is: 6.1) [master] joshrup/FreshDemo#124

Open

bootstrap-3.1.1.min.js: 6 vulnerabilities (highest severity is: 6.1) [main] BogdanOrg/WebGoat-DEV#68

Open

bootstrap-3.3.4.js: 6 vulnerabilities (highest severity is: 6.1) [main] BogdanOrg/benchmark-java#11

Open

bootstrap-3.3.4.min.js: 6 vulnerabilities (highest severity is: 6.1) [main] BogdanOrg/benchmark-java#21

Open

bootstrap-3.1.1.min.js: 6 vulnerabilities (highest severity is: 6.1) [develop] BogdanOrg/WebGoat-PROD#275

Open

bootstrap-3.3.7.jar: 4 vulnerabilities (highest severity is: 6.1) [develop] BogdanOrg/WebGoat-PROD#282

Open

bootstrap-3.2.0.min.js: 6 vulnerabilities (highest severity is: 6.1) [main] BogdanOrg/mojoportal#7

Open

bootstrap-3.2.0.js: 6 vulnerabilities (highest severity is: 6.1) [main] BogdanOrg/mojoportal#26

Open

bootstrap-3.1.1.min.js: 6 vulnerabilities (highest severity is: 6.4) [dependabot/github_actions/devops-infra/action-commit-push-1.0.3] blemaire-wavetel/WebGoat#10

Open

bootstrap-4.1.0.min.js: 4 vulnerabilities (highest severity is: 6.1) [all-contributors/add-Hkakashi] blemaire-wavetel/pygoat#6

Open

renovate bot mentioned this pull request

bootstrap-3.3.7.min.js: 6 vulnerabilities (highest severity is: 6.1) [master] normanwenzel-repo-integration-test/easybuggy#5

Open

This was referenced Dec 14, 2025

bootstrap-3.3.7.jar: 6 vulnerabilities (highest severity is: 6.1) [main] (unreachable) GarySegal-MendDemo-DevPlatform/JavaDemo-Remediate#18

Open

bootstrap-3.3.7.jar: 6 vulnerabilities (highest severity is: 5.3) [main] (unreachable) - autoclosed AS-Mend/WebGoat8#138

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels