It looks like it's possible to inject Javascript code with the data-content option.
When data-content="<img src=x onerror=console.log('hello')">, the onerror attribute is correctly removed from the generated HTML but it looks like the value is interpreted ("hello" is displayed in the JS console).
Is it the expected behaviour ?
<html>
<head>
<title>XSS Injection</title>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap-select/1.13.8/css/bootstrap-select.css">
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css">
<script src="https://code.jquery.com/jquery-3.3.1.min.js"></script>
<script src="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.bundle.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap-select/1.13.18/js/bootstrap-select.js"></script>
</head>
<body>
<select class="selectpicker">
<option data-content="<img src='x' onerror='console.log(9)'>">hello</option>
</select>
</body>
</html>Here is a JSFiddle illustrating the issue
It looks like it's possible to inject Javascript code with the
data-contentoption.When
data-content="<img src=x onerror=console.log('hello')">, theonerrorattribute is correctly removed from the generated HTML but it looks like the value is interpreted ("hello" is displayed in the JS console).Is it the expected behaviour ?
Here is a JSFiddle illustrating the issue