Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

[security issue!] Documentation change needed to prevent accidental XSS

See original GitHub issue

The documentation and examples for the template(Result|Selection) functions (and possibly others?) should warn that .nodeValue – and therefore jQuery’s .text() – and therefore select2’s item.text – can return unescaped (valid) HTML.

See https://jsbin.com/zosigigece/edit?html,js,output using Chrome

The code there is just a slightly-modified version of the example in the current documentation in order to show the vulnerability.

Select2 version: latest (4.0.6-rc.0) Chrome version: 71.0.3578.98 OS: macOS 10.14.2

Issue Analytics

State:
Created 5 years ago
Reactions:2
Comments:5 (2 by maintainers)

Top GitHub Comments

1reaction

kevin-browncommented, Jul 10, 2019

Fixed in https://github.com/select2/docs/commit/1c394a421b76f26b8923a9634437b99fb6bffec3 and https://github.com/select2/docs/commit/1f79acbe5ffa651dfdbed70d6c955c2ee4447cfa. This will go out in the next docs push.

1reaction

etiptoncommented, May 1, 2019

If it helps, here’s the html-escaping functionality I’ve used for awhile now, when needed: http://shebang.brandonmintern.com/foolproof-html-escaping-in-javascript/

Top Results From Across the Web

【Cross Site Scripting Prevention】Protect and Prevent XSS

How to prevent XSS attacks? Cross site scripting defense is important to avoid vulnerabilities and future attacks. Check now our list.

10.1. Preventing Cross Site Scripting Vulnerabilities

Cross Site Scripting (XSS) vulnerabilities allow user-supplied data to be incorrectly executed as code in a web browser. It can be difficult to...

Protect from cross-site scripting attacks - IBM Garage Practices

To prevent XSS attacks, your application must validate all the input data, make sure that only the allowlisted data is allowed, and ensure...

Effective Ways to Prevent Cross Site Scripting(XSS) Attacks

Their primary goal is to get the project finished Websites developed with unsecure coding can be easily exploited by the attackers. There is...

Recommended Practice Case Study: Cross-Site Scripting - CISA

This document was developed for the U.S. Department of Homeland. Security to provide guidance for control system cyber security. The author team consisted...