[#22844] - [BS2] Fix for XSS issue with data-target attributes in BS2 JS
- Fixed in Code Base
- 8 Mar 2019
- Medium
- Build: staging
- # 22844
- Diff
- zero-24:bs2_patch
- Success continuous-integration/travis-ci/pr The Travis CI build passed Details
- Success continuous-integration/appveyor/pr AppVeyor build succeeded Details
- Success continuous-integration/drone/pr the build was successful Details
User tests: Successful: Unsuccessful:
Summary of Changes
This patch by @SniperSister fixes an publicly known XSS Problem in the BS2 JS reported to the JSST by @C-Lodder. As this issue is publicly known and can also impact 3rd partys the JSST decided to patch it in the public tracker. This also allows an wider group of people to test this patch.
Testing Instructions
Make sure the following bootstrap js components still work
- Alert
- Carousel
- Collapse
- Dropdown
- Modal
- Scrollspy
- Tab
Try using the data-target and href methods and also try to verify that the mentioned components still work in the Joomla backend.
Expected result
BS JS Code still works
Actual result
The current JS Code has an know and publicly documented XSS Problem
Documentation Changes Required
none
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | JavaScript |
| Labels |
Added:
?
|
||
tested
- alert
- collapse
- dropdown
- modal
- tab
and still works in the Joomla backend
unable to test carousel & scrollspy (don't know where these are used in the backend)
sorry i'm not a js guy
Any chance to get a look on this from @dgrammatiko ?
@HLeithner looks fine here
Is this related to frontend or backend? In frontend, I use BS3 for my extensions.
I have tested this item
Tested Joomla! 3.9.3 administration: Alert, Modal, Tab with 3pd extensions (Phoca Gallery, Phoca Download, Phoca Cart) and it seems like everything is OK
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/22844.
I have tested this item
I have tested the Carousel creating a custom code with: https://getbootstrap.com/2.3.2/javascript.html#carousel
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/22844.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/22844.
Thanks for your tests
I would like to see the JED tested with it
I would like to see the JED tested with it
This is not a practical request. Extension code is not stored in the JED or in a resource available within the JED, and it is not within the JED's role in relation to core development to audit or test extensions against any core change.
My request is to test the jed, not extensions from jed.
And don't worry I will do it my self.
| Labels |
Added:
?
|
||
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-03-08 11:29:07 |
| Closed_By | ⇒ | HLeithner |
thx all for there work.
We might can get some tests or some kind of Feedback here?
What does hold you off testing? Is it unclear what to test?
Whatvholds you up providing Feedback? Let me know we really want to get this fixed. cc @SniperSister