News for hackers. Stuff that matters.

A comment on Bootstrap 4 Beta. Parent comment

Re:Bootstrap 4 Beta by geekamongus on Friday August 11, 2017 @01:04PM (#14991962)
I will echo this person: "This was found in an application where data-target was based on user input and only passed through standard HTML entities encoding. There is no reason why data-target should interpret HTML so while not impacting many applications it should be fixed in my opinion."

https://github.com/twbs/bootstrap/issues/20184#issuecomment-...

[ Parent | on HN ]
Re:Bootstrap 4 Beta by ceejayoz on Friday August 11, 2017 @02:22PM (#14992752)
Echoing a wrong statement doesn't make it any less wrong.

If you don't want XSS, don't echo untrusted raw user input to the browser. Not in the title tag, not in a paragraph body, not in a data attribute. It's on you, or your application framework. Expecting Bootstrap to combat it is insane.

[ Parent | on HN ]