[Dropdown] Security Vulnerability with data-text

When adding the data-text option to dropdown item’s, when the user clicks on them the contents are executed. Here is a simple JSFiddle with two dropdowns: http://jsfiddle.net/daneren2005/7x4jqbe7/2/. The top one uses data-text and you will get a popup XSS when you select the only option. The second does not use it and isn’t vulnerable.

[lubber-de]

We implemented data sanitizing and added a security page to the docs https://fomantic-ui.com/modules/dropdown.html#/security

[jlukic]

This is not a security issue, removing html parsing is already a setting.

$('.ui.dropdown.selection').dropdown({preserveHTML: false});

No alert in this jsfiddle fork http://jsfiddle.net/15pw0Lku/

It’s up to implementors to decide if they want to prevent this behavior. This can also be solved with CSP.