Hi donnerlin,

I've been doing some investigating - I think this relates to the ability to use custom HTML code within the Tooltip:

In a nutshell, cross-site scripting relates to how a user (with malicious intent), could try to intercept the HTML code that forms the content within the Tooltip, and replace it (or "inject") with their own code - this code could do any level of damage, depending on what is injected.

It does open up a can of worms as to how best to protect against it - the Tools library was originally intended to be a pet project of Tero (of Flowplayer fame - www.flowplayer.org). It therefore wasn't necessarily going to include the level of functionality or security of other libraries, but would give any developer enough flexibility to run with the code and do as they wish. (FYI: I came along to help out in the original forums, and now here in Github, as time permits!).

In terms of how to go forward - there are several options available here; the key to all of this is to keep in mind your intended audience, and whether they are internal or network users - this will become clear in a moment.

Make sure your pages have the correct charset in the code - it will be something like meta charset='UTF-8. This will help IE correctly identify the character set that will be used in your pages. If you need an example of how this should look, please shout.
I would recommend at least not including HTML code in the Tooltip - I know this is possible with Tool's Tooltip functionality, but the library was written at a time when cross-site scripting was less of an issue than it is now. I know of at least one other library that doesn't allow HTML code within it's Tooltip.
If you need to, then ensure your code is "escaped" - this is probably outside of the scope of what can be included here, but there are HUNDREDS of articles on the Internet for this ;-) Put simply, it means changing any HTML tags such as "" to their escaped equivalents, which here would be "&lthtml&gt". Please note - this should be done for ALL HTML tags used within the tooltip; it's meant to reduce any instance where an attacker could intercept the HTML code, and replace it with their own. As a start - have a look through this StackOverflow article carefully - there are some good tips there: http://stackoverflow.com/questions/24816/escaping-html-strings-with-jquery.
I have also found that some kind soul has actually written a patch for this issue, which is available at fix xss bug on tooltip initialize #853; I've not had any chance to fully investigate or test it yet, but will do so as soon as I get a spare moment.

I hope the above helps - please do let me know how you get on!

Security issue with tooltip #1037

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.