3 ms·
I will echo this person: "This was found in an application where data-target was based on user input and only passed through standard HTML entities encoding. Th
by geekamongus 9y ago
I will echo this person:
"This was found in an application where data-target was based on user input and only passed through standard HTML entities encoding. There is no reason why data-target should interpret HTML so while not impacting many applications it should be fixed in my opinion."
https://github.com/twbs/bootstrap/issues/20184#issuecomment-229337015 https://github.com/twbs/bootstrap/issues/20184#issuecomment-...
- ceejayoz 9y agoEchoing a wrong statement doesn't make it any less wrong. If you don't want XSS, don't echo untrusted raw user input to the browser. Not in the title tag, not in a paragraph body, not in a data attribute. It's on you, or your application framework. Expecting Bootstrap to combat it is insane.