rooty/Bootstrap
0
0
Fork 0
mirror of https://github.com/twbs/bootstrap.git synced 2024-12-01 13:24:25 +01:00
Code Issues Actions Packages Releases Activity

fix(tooltip): xss in container option

Browse Source
This commit is contained in:
Johann-S 2018-05-30 09:41:05 +02:00
parent e3084c3842
commit 2d90d369bb
2 changed files with 34 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/tooltip.js
View File

@ -273,7 +273,7 @@ const Tooltip = (($) => {
const attachment = this._getAttachment(placement)
this.addAttachmentClass(attachment)
const container = this.config.container === false ? document.body : $(this.config.container)
const container = this.config.container === false ? document.body : $(document).find(this.config.container)
$(tip).data(this.constructor.DATA_KEY, this)

13
js/tests/visual/tooltip.html
View File

@ -27,6 +27,7 @@
<hr>
<div class="row">
<p>
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="auto" title="Tooltip on auto">
Tooltip on auto
@ -43,11 +44,23 @@
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="left" title="Tooltip on left">
Tooltip on left
</button>
</p>
</div>
<div class="row">
<p>
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="left" title="Tooltip with XSS" data-container="<img src=1 onerror=alert(123) />">
Tooltip with XSS
</button>
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="left" title="Tooltip with container" data-container="#customContainer">
Tooltip with container
</button>
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-html="true" title="<em>Tooltip</em> <u>with</u> <b>HTML</b>">
Tooltip with HTML
</button>
</p>
</div>
<div id="target" title="Test tooltip on transformed element"></div>
<div id="customContainer"></div>
</div>
<script src="../../../assets/js/vendor/jquery-slim.min.js"></script>