Fix code scanning alert issue-#1353

OWASP-BLT · Nov 1, 2023 · e0951b4 · e0951b4
1 parent 1005957
commit e0951b4
Showing 1 changed file with 12 additions and 1 deletion.
diff --git a/website/static/vendor/bootstrap/js/bootstrap.js b/website/static/vendor/bootstrap/js/bootstrap.js
@@ -19,6 +19,11 @@ function sanitizeSelector(selector) {
     // Use a whitelist approach to only allow valid characters in a selector
     return selector.replace(/[^\w-#.:]/g, '');
 }
+function sanitizeInput(input) {
+    var div = document.createElement('div');
+    div.appendChild(document.createTextNode(input));
+    return div.innerHTML;
+}
 /* ========================================================================
  * Bootstrap: transition.js v3.3.7
  * http://getbootstrap.com/javascript/#transitions
@@ -1576,7 +1581,13 @@ function sanitizeSelector(selector) {
 
     Tooltip.prototype.setContent = function () {
         var $tip = this.tip()
-        var title = escapeHTML(this.getTitle())
+        var title = this.getTitle()
+        if(this.options.html){
+            title = sanitizeInput(title);
+        }
+        else{
+            title = sanitizeSelector(title);
+        }
 
         $tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
         $tip.removeClass('fade in top bottom left right')