Script tag is not escaped when using :option="" in form-select

I was trying to do some XSS in my project and I got some un-shown text. Which I found out that it was the cause of the script tag that was not escaped… So I tried doing a v-for loop inside an <option> tag and use {{ }} (Double brackets) to escaped the script tag. I would like to make a pull request sadly bootstrap_vue is using a render less components (I don’t really know but it’s using render function) which I don’t have much knowledge about. So I just submitted an Issue here.

by the way you can replicate the problem using the Live documentation on Bootstrap_vue site.

My browser: Opera Operating System: Fedora LXDE

[Remigius2011]

@pi0 i have already changed my code to use slots after discovering the vulnerabilities in my app. so actually it is up to you and the team to decide on whether to minimize changes in bootstrap-vue or the likelyhood of other developers to introduce vulnerabilities in her/his app (i would opt for the latter if i were to decide).

i agree with your point in the clarification letter that separating trusted from untrusted input is not (and cannot be) the task of bootstrap-vue (and hence any html sanitization - including removal of <script> tags, which is neither necessary nor sufficient - can be dropped), but providing separate channels for trusted (html) and untrusted (text) data is important, and it vould avoid confusion and wrong expectations if the respective properties were named and documented accordingly. but clearly, the two channels are already there: the text property for trusted html and the slot for untrusted text.

[Remigius2011]

imho: nope! app developers would then end up doubling their code for sanitizing all texts…

Seriously, see e.g. the description of v-html in the vuejs doc: https://vuejs.org/v2/guide/syntax.html#Raw-HTML

If you have a property called options.text you are alluding this is interpreted as text and hence passed to a text-like property (domProps.textContent in this case). Otherwise it should be called options.html (which could exist simultaneously and be passed into innerHTML. Otherwise, this should be clearly documented to avoid security risks (I assume more than 90% of app developers who pass in user input will not sanitize it and have a security vulnerability in their app). Please feel free to consult resources of the security folklore to make an informed decision - but at least add some documentation that the property options.text is not secure (i.e. treated as HTML - similar to the remarks for v-html) and explicit options should be used instead if the content is untrusted (e.g. select controls filled from database content and/or user input).