XSS in data-target attribute

[lpilorz]

The data-target attribute is vulnerable to Cross-Site Scripting attacks:

<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
<script src="http://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js"></script>
<button data-toggle="collapse" data-target="<img src=x onerror=alert(0)>">Test</button>

[lpilorz]

I guess the fix for this specific issue could be changing getTargetFromTrigger function:

return $(target)

to:

return $(document.querySelector(target))

but it seems the same problem is present in other places too.

Here is another example:

<a href="<img src=x onerror=alert(0)>" data-dismiss="alert">Test</a>

[XhmikosR]

@cvrebert: how do you think we should address this?

[cvrebert]

return $(document.querySelector(target))

I don't think that's a viable option compatibility-wise. Bootstrap 3 supports IE8, and its CSS selector support differs from jQuery's: http://caniuse.com/#feat=queryselector

Based on https://bugs.jquery.com/ticket/11290, I guess we could try something like:

if (/\s*</.test(target)) {
  return $()
}

@dmethvin Sorry to trouble you, but does this sound like a good workaround?

(It's a shame jQuery doesn't have an "only interpret this as a selector, never as HTML" API.)

[dmethvin]

You could use $(document).find(target) instead, that won't be interpreted as HTML.

How is this cross-site? Where does the HTML come from and how does the attacker control it?

[lpilorz]

This was found in an application where data-target was based on user input and only passed through standard HTML entities encoding. There is no reason why data-target should interpret HTML so while not impacting many applications it should be fixed in my opinion.

[mdo]

Bootstrap 3 is no longer being officially developed or supported.

All work has moved onto our next major release, v4. As such, this issue or pull request is being closed as a "won't fix." For additional help and support, we recommend utilizing our community resources. Thanks for your understanding, and see you on the other side of v4!

<3,
@mdo and team

[skokkanthi]

Dear @mdo @cvrebert is this issue fixed in V4? Please let me know. If yes, can you please give me the commit related to this.

[meeque]

I know this one's closed, but what's the status for v4? I can see that it is still affected by this vulnerability:

https://github.com/twbs/bootstrap/blob/v4-dev/js/src/util.js#L120

I recommend to mitigate it by applying @dmethvin's proposal. (Also see comits on @vanduynslagerp's fork.)

Should I prepare a pull request? Or should I open a new issue for v4?

[Johann-S]

Yes you can make a PR @meeque for this issue which is still present 👍

[XhmikosR]

You could make a PR against v3-dev branch too if you want.

[meeque]

Let's start off with a test case: http://jsbin.com/qalekeroke/edit?html,output