Seems like the drag template is vulnerable for XSS attacks

We create a drag item template which is based on user’s input (e.g. item name). Seems that this behaviour is vulnerable for XSS attack, in case the user put a script tag in the item name. We can sanitize user’s input, but as developers usually rely on Angular automatic sanitization process, we think that the data-jqyoui-options directive should take care of this as well, if possible.

For example, try to define this draggable item:

<div
   data-drag="true"
   jqyoui-draggable
   data-jqyoui-options="{helper: getItemDragTemplate(), appendTo: 'body'}">

Where the getItemDragTemlpate is:

<div>item.name</div>

Where item.name is some user malicious input, for example:

<script>alert('hello')</script>

Dragging such an item will cause the script to run.

[benbracha]

I’m not sure I follow… because jqueryUI draggable, which you use, allows to change the markup. This is done by providing a function through an “helper” property: https://api.jqueryui.com/draggable/#option-helper

All I’m saying is that, if helper is a function - it must return a DOM element, which means it should be sanitized (or at least optional sanitized…).

[codef0rmer]

@benbracha I really appreciate your efforts in providing the solution. However, not everybody allows to modify the markup before dragging/dropping unlike your requirement. That’s why I did not want to add the fix in angular-dragdrop. I hope it clarifies the issue.