Skip to content

Commit 2d90d36

Browse files
committed
fix(tooltip): xss in container option
1 parent e3084c3 commit 2d90d36

File tree

2 files changed

+34
-21
lines changed

2 files changed

+34
-21
lines changed

js/src/tooltip.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -273,7 +273,7 @@ const Tooltip = (($) => {
273273
const attachment = this._getAttachment(placement)
274274
this.addAttachmentClass(attachment)
275275

276-
const container = this.config.container === false ? document.body : $(this.config.container)
276+
const container = this.config.container === false ? document.body : $(document).find(this.config.container)
277277

278278
$(tip).data(this.constructor.DATA_KEY, this)
279279

js/tests/visual/tooltip.html

Lines changed: 33 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -27,27 +27,40 @@ <h1>Tooltip <small>Bootstrap Visual Test</small></h1>
2727

2828
<hr>
2929

30-
<p>
31-
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="auto" title="Tooltip on auto">
32-
Tooltip on auto
33-
</button>
34-
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="top" title="Tooltip on top">
35-
Tooltip on top
36-
</button>
37-
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="right" title="Tooltip on right">
38-
Tooltip on right
39-
</button>
40-
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="bottom" title="Tooltip on bottom">
41-
Tooltip on bottom
42-
</button>
43-
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="left" title="Tooltip on left">
44-
Tooltip on left
45-
</button>
46-
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-html="true" title="<em>Tooltip</em> <u>with</u> <b>HTML</b>">
47-
Tooltip with HTML
48-
</button>
49-
</p>
30+
<div class="row">
31+
<p>
32+
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="auto" title="Tooltip on auto">
33+
Tooltip on auto
34+
</button>
35+
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="top" title="Tooltip on top">
36+
Tooltip on top
37+
</button>
38+
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="right" title="Tooltip on right">
39+
Tooltip on right
40+
</button>
41+
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="bottom" title="Tooltip on bottom">
42+
Tooltip on bottom
43+
</button>
44+
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="left" title="Tooltip on left">
45+
Tooltip on left
46+
</button>
47+
</p>
48+
</div>
49+
<div class="row">
50+
<p>
51+
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="left" title="Tooltip with XSS" data-container="<img src=1 onerror=alert(123) />">
52+
Tooltip with XSS
53+
</button>
54+
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-placement="left" title="Tooltip with container" data-container="#customContainer">
55+
Tooltip with container
56+
</button>
57+
<button type="button" class="btn btn-secondary" data-toggle="tooltip" data-html="true" title="<em>Tooltip</em> <u>with</u> <b>HTML</b>">
58+
Tooltip with HTML
59+
</button>
60+
</p>
61+
</div>
5062
<div id="target" title="Test tooltip on transformed element"></div>
63+
<div id="customContainer"></div>
5164
</div>
5265

5366
<script src="../../../assets/js/vendor/jquery-slim.min.js"></script>

0 commit comments

Comments
 (0)