diff options
| author | Johann-S <johann.servoire@gmail.com> | 2017-08-25 22:54:49 +0300 |
|---|---|---|
| committer | Johann-S <johann.servoire@gmail.com> | 2017-08-26 01:20:14 +0300 |
| commit | bcad4bcb5f5a9ef079b2883a48a698b35261e083 (patch) | |
| tree | a1815bdc3b26c9086e8aa9deffa5a6b6d3f8c49a /js/tests/visual/modal.html | |
| parent | ba6a6f13691000ffaf22ef8e731513737659447f (diff) | |
Fix XSS in data-target
Diffstat (limited to 'js/tests/visual/modal.html')
| -rw-r--r-- | js/tests/visual/modal.html | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/js/tests/visual/modal.html b/js/tests/visual/modal.html index c9a950b8c3..da9bbf93ab 100644 --- a/js/tests/visual/modal.html +++ b/js/tests/visual/modal.html @@ -167,6 +167,10 @@ <div class="bg-dark text-white p-2" id="tall" style="display: none;"> Tall body content to force the page to have a scrollbar. </div> + + <button type="button" class="btn btn-secondary btn-lg" data-toggle="modal" data-target="<div class="modal fade the-bad" tabindex="-1" role="dialog"><div class="modal-dialog" role="document"><div class="modal-content"><div class="modal-header"><button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button><h4 class="modal-title">The Bad Modal</h4></div><div class="modal-body">This modal's HTTML source code is declared inline, inside the data-target attribute of it's show-button</div></div></div></div>"> + Modal with an XSS inside the data-target + </button> </div> <script src="../../../assets/js/vendor/jquery-slim.min.js"></script> |