Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
Possible XSS in data-date-container attribute
See original GitHub issueExpected behaviour
Data-date-container
should use jQuery find method to find the selector instead of placing it right away in the jQuery selector
Actual behaviour
Text is placed in jQuery selector as element, so the element is created and the XSS is performed.
Datepicker version used
1.8.0
Example code
https://jsfiddle.net/rsvnyf9a/
PS: https://uxsolutions.github.io/bootstrap-datepicker/ Demo page sandbox-js element is vulnerable for XSS, because the html is loaded straight into the pre element. Just type <img src=1 onerror=alert(123) /> into an input.
Issue Analytics
- State:
- Created 5 years ago
- Comments:7
Top Results From Across the Web
Top Related Medium Post
Top Related StackOverflow Question
Troubleshoot Live Code
Top Related Reddit Thread
Top Related Hackernoon Post
Top Related Tweet
Top Related Dev.to Post
Top Related Hashnode Post
@rjoshi18 https://github.com/uxsolutions/bootstrap-datepicker/blob/2a54f44e54ea7c3ac7bfdf7d42801535e56ad2a1/js/bootstrap-datepicker.js#L674 This is the line I think where the Jquery find method should be used, like https://github.com/twbs/bootstrap/pull/23679/commits/2ba83171807bdec8ce5235042e6abfc6906a1d09
See my JSFiddle: If you provider the XSS to the
data-date-containerattribute the XSS will trigger.Can’t seem to reproduce this anymore.