4 ms·

For me, the bloat isn't as big a problem as the fact the 3.x is unmaintained and has at least one known security vulnerability. https://github.com/twbs/bootstr

For me, the bloat isn't as big a problem as the fact the 3.x is unmaintained and has at least one known security vulnerability. https://github.com/twbs/bootstrap/issues/20184#issuecomment-244818062 https://github.com/twbs/bootstrap/issues/20184#issuecomment-...

heartbreak 9y ago
That’s as much a vulnerability as <script> letting me pipe user input to it. Should I? Of course not. Can I? Yes. Is it a flawed feature for this reason? No.
ceejayoz 9y ago
Calling that a security vulnerability is quite the stretch.
- geekamongus 9y ago
  I am not sure how an XSS vulnerability is considered a stretch. Perhaps the likelihood of it is low. Is that what you meant? That still doesn't address the overall point, which is that Bootstrap 3 is no longer maintained, according to its project Owner, and this or any future vulnerabilities may or may not be patched. That seems like a significant risk to me.
  - ceejayoz 9y ago
    It's not an XSS vulnerability in Bootstrap for the same reasons <div class="row"> UNESCAPED USER INPUT </div> or <img src="UNESCAPED USER INPUT"> aren't - escaping user input is up to the developer, not Bootstrap. Being essentially a static HTML/CSS framework with a bit of well-tested optional JS, Bootstrap's attack surface is minimal, making future vulnerabilities a pretty unlikely situation. A quick perusal of Github's issues search for "security" finds nothing significant in the past.
    - geekamongus 9y ago
      I will echo this person: "This was found in an application where data-target was based on user input and only passed through standard HTML entities encoding. There is no reason why data-target should interpret HTML so while not impacting many applications it should be fixed in my opinion." https://github.com/twbs/bootstrap/issues/20184#issuecomment-229337015 https://github.com/twbs/bootstrap/issues/20184#issuecomment-...
      - ceejayoz 9y ago
        Echoing a wrong statement doesn't make it any less wrong. If you don't want XSS, don't echo untrusted raw user input to the browser. Not in the title tag, not in a paragraph body, not in a data attribute. It's on you, or your application framework. Expecting Bootstrap to combat it is insane.

heartbreak 9y ago

That’s as much a vulnerability as <script> letting me pipe user input to it. Should I? Of course not. Can I? Yes. Is it a flawed feature for this reason? No.

ceejayoz 9y ago

Calling that a security vulnerability is quite the stretch.

geekamongus 9y ago
I am not sure how an XSS vulnerability is considered a stretch. Perhaps the likelihood of it is low. Is that what you meant? That still doesn't address the overall point, which is that Bootstrap 3 is no longer maintained, according to its project Owner, and this or any future vulnerabilities may or may not be patched. That seems like a significant risk to me.
- ceejayoz 9y ago
  It's not an XSS vulnerability in Bootstrap for the same reasons <div class="row"> UNESCAPED USER INPUT </div> or <img src="UNESCAPED USER INPUT"> aren't - escaping user input is up to the developer, not Bootstrap. Being essentially a static HTML/CSS framework with a bit of well-tested optional JS, Bootstrap's attack surface is minimal, making future vulnerabilities a pretty unlikely situation. A quick perusal of Github's issues search for "security" finds nothing significant in the past.
  - geekamongus 9y ago
    I will echo this person: "This was found in an application where data-target was based on user input and only passed through standard HTML entities encoding. There is no reason why data-target should interpret HTML so while not impacting many applications it should be fixed in my opinion." https://github.com/twbs/bootstrap/issues/20184#issuecomment-229337015 https://github.com/twbs/bootstrap/issues/20184#issuecomment-...
    - ceejayoz 9y ago
      Echoing a wrong statement doesn't make it any less wrong. If you don't want XSS, don't echo untrusted raw user input to the browser. Not in the title tag, not in a paragraph body, not in a data attribute. It's on you, or your application framework. Expecting Bootstrap to combat it is insane.