mirror_css/bootstrap
1
0
Fork 0
mirror of https://github.com/twbs/bootstrap.git synced 2025-08-13 00:54:04 +02:00
Code Issues Releases Wiki Activity

Prevent getSelector from returning URLs as selector (#32586)

Browse Source 
* added checks to getSelector in util to prevent returning hrefs that are invalid selectors

* restored compatibility for the class selector and added test cases for keeping urls from being returned as a selector

Co-authored-by: XhmikosR <xhmikosr@gmail.com>
This commit is contained in:
Florian Vick
2021-02-03 20:58:54 +01:00
committed by GitHub
parent 3770b7b9e3
commit 2a9d72133d
2 changed files with 36 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
js/src/util/index.js
View File

@@ -36,7 +36,20 @@ const getSelector = element => {
let selector = element.getAttribute('data-bs-target')
if (!selector || selector === '#') {
const hrefAttr = element.getAttribute('href')
let hrefAttr = element.getAttribute('href')
// The only valid content that could double as a selector are IDs or classes,
// so everything starting with `#` or `.`. If a "real" URL is used as the selector,
// `document.querySelector` will rightfully complain it is invalid.
// See https://github.com/twbs/bootstrap/issues/32273
if (!hrefAttr || (!hrefAttr.includes('#') && !hrefAttr.startsWith('.'))) {
return null
}
// Just in case some CMS puts out a full URL with the anchor appended
if (hrefAttr.includes('#') && !hrefAttr.startsWith('#')) {
hrefAttr = '#' + hrefAttr.split('#')[1]
}
selector = hrefAttr && hrefAttr !== '#' ? hrefAttr.trim() : null
}