Escaped tags parsed as non-escaped in title and data-content

[latuszek]

The bootstrap-select does not respect escaped content correctly. Instead the escaped content is rendered as it would not be escaped.
Sample can be seen here: https://jsfiddle.net/b1dhf8ec/2/

[caseyjhol]

You're right - the title is not being escaped properly. However, there's nothing that can be done about the escaped content (as its purpose is to display HTML). Since < is displayed as < in the native HTML, there is no way for bootstrap-select to determine that it's supposed to be decoded. A workaround, if you want to display <i>italicized text</i> instead of italicized text as the option's content is to swap out the & with & in the escaped HTML entity. Example:

<i>italicized text</i>

instead of

<i>italicized text</i&gt

[latuszek]

I understand You want to have an option to define data-content="<i>italicized text</i&gt" instead of data-content="<i>italicized text</i>" and I think it is reasonable.
However, it should be mentioned in the documentation as some of the content may come from user input (this is my case - I'm displaying there info about registered company).
All proper front-end frameworks escapes displayed content and change vulnerable characters to the escaped form but in this case it will not help and currently most developers will be unaware of this.

[caseyjhol]

Can you elaborate a bit? What specifically do you want mentioned in the documentation? I added a note about the potential for an XSS attack when using the data-content feature in commit d2333c8. Unfortunately, < being converted to a literal < when inside an HTML attribute is a limit bootstrap-select has no control over.

[latuszek]

Something like you've written but I would also mention that it converts HTML-escaped characters to their real value like <i> will become <i>. But you have some exceptions from this (like the <script> tag) which, I think, is also worth mention.

BTW thanks for really good component.

[lirantal]

+1, and many thanks @caseyjhol for your dedication to handle security issues! 👏

[caseyjhol]

Released in v1.13.6!

[mcoops]

Retrospectively, CVE-2019-20921 has been assigned to this issue.