add html option back to tooltip and popover to explicitly prevent XSS #3421

docs/assets/js/bootstrap-popover.js

@@ -43,8 +43,8 @@
         , title = this.getTitle()
         , content = this.getContent()
 
-      $tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
+      $tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
-      $tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
+      $tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)
 
       $tip.removeClass('fade top bottom left right in')
     }

docs/assets/js/bootstrap-tooltip.js

@@ -148,20 +148,11 @@
       }
     }
 
-  , isHTML: function(text) {
-      // html string detection logic adapted from jQuery
-      return typeof text != 'string'
-        || ( text.charAt(0) === "<"
-          && text.charAt( text.length - 1 ) === ">"
-          && text.length >= 3
-        ) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
-    }
-
   , setContent: function () {
       var $tip = this.tip()
         , title = this.getTitle()
 
-      $tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
+      $tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
       $tip.removeClass('fade in top bottom left right')
     }
 
@@ -270,6 +261,7 @@
   , trigger: 'hover'
   , title: ''
   , delay: 0
+  , html: true
   }
 
 }(window.jQuery);

docs/assets/js/bootstrap.js

@@ -1092,20 +1092,11 @@
       }
     }
 
-  , isHTML: function(text) {
-      // html string detection logic adapted from jQuery
-      return typeof text != 'string'
-        || ( text.charAt(0) === "<"
-          && text.charAt( text.length - 1 ) === ">"
-          && text.length >= 3
-        ) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
-    }
-
   , setContent: function () {
       var $tip = this.tip()
         , title = this.getTitle()
 
-      $tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
+      $tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
       $tip.removeClass('fade in top bottom left right')
     }
 
@@ -1214,6 +1205,7 @@
   , trigger: 'hover'
   , title: ''
   , delay: 0
+  , html: true
   }
 
 }(window.jQuery);
@@ -1262,8 +1254,8 @@
         , title = this.getTitle()
         , content = this.getContent()
 
-      $tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
+      $tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
-      $tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
+      $tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)
 
       $tip.removeClass('fade top bottom left right in')
     }

docs/javascript.html

@@ -771,6 +771,12 @@ $('a[data-toggle="tab"]').on('shown', function (e) {
                <td>true</td>
                <td>apply a css fade transition to the tooltip</td>
              </tr>
+             <tr>
+               <td>html</td>
+               <td>boolean</td>
+               <td>true</td>
+               <td>Insert html into the tooltip. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.</td>
+             </tr>
              <tr>
                <td>placement</td>
                <td>string|function</td>
@@ -874,6 +880,12 @@ $('a[data-toggle="tab"]').on('shown', function (e) {
                <td>true</td>
                <td>apply a css fade transition to the tooltip</td>
              </tr>
+             <tr>
+               <td>html</td>
+               <td>boolean</td>
+               <td>true</td>
+               <td>Insert html into the tooltip. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.</td>
+             </tr>
              <tr>
                <td>placement</td>
                <td>string|function</td>

docs/templates/pages/javascript.mustache

@@ -693,6 +693,12 @@ $('a[data-toggle="tab"]').on('shown', function (e) {
                <td>true</td>
                <td>{{_i}}apply a css fade transition to the tooltip{{/i}}</td>
              </tr>
+             <tr>
+               <td>{{_i}}html{{/i}}</td>
+               <td>{{_i}}boolean{{/i}}</td>
+               <td>true</td>
+               <td>{{_i}}Insert html into the tooltip. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.{{/i}}</td>
+             </tr>
              <tr>
                <td>{{_i}}placement{{/i}}</td>
                <td>{{_i}}string|function{{/i}}</td>
@@ -796,6 +802,12 @@ $('a[data-toggle="tab"]').on('shown', function (e) {
                <td>true</td>
                <td>{{_i}}apply a css fade transition to the tooltip{{/i}}</td>
              </tr>
+             <tr>
+               <td>{{_i}}html{{/i}}</td>
+               <td>{{_i}}boolean{{/i}}</td>
+               <td>true</td>
+               <td>{{_i}}Insert html into the popover. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.{{/i}}</td>
+             </tr>
              <tr>
                <td>{{_i}}placement{{/i}}</td>
                <td>{{_i}}string|function{{/i}}</td>

js/bootstrap-popover.js

@@ -43,8 +43,8 @@
         , title = this.getTitle()
         , content = this.getContent()
 
-      $tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
+      $tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
-      $tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
+      $tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)
 
       $tip.removeClass('fade top bottom left right in')
     }

js/bootstrap-tooltip.js

@@ -148,20 +148,11 @@
       }
     }
 
-  , isHTML: function(text) {
-      // html string detection logic adapted from jQuery
-      return typeof text != 'string'
-        || ( text.charAt(0) === "<"
-          && text.charAt( text.length - 1 ) === ">"
-          && text.length >= 3
-        ) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
-    }
-
   , setContent: function () {
       var $tip = this.tip()
         , title = this.getTitle()
 
-      $tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
+      $tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
       $tip.removeClass('fade in top bottom left right')
     }
 
@@ -270,6 +261,7 @@
   , trigger: 'hover'
   , title: ''
   , delay: 0
+  , html: true
   }
 
 }(window.jQuery);