Skip to content

Commit

Permalink
add html option back to tooltip and popover to explicitly prevent XSS #…
Browse files Browse the repository at this point in the history 
…3421
  • Loading branch information
@fat
fat committed Jun 3, 2012
1 parent fc96bc8 commit f836473
Show file tree
Hide file tree
Showing 8 changed files with 37 additions and 37 deletions.
4 changes: 2 additions & 2 deletions docs/assets/js/bootstrap-popover.js
View file
Expand Up @@ -43,8 +43,8 @@
, title = this.getTitle()
, content = this.getContent()

$tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
$tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)

$tip.removeClass('fade top bottom left right in')
}
Expand Down
12 changes: 2 additions & 10 deletions docs/assets/js/bootstrap-tooltip.js
View file
Expand Up @@ -148,20 +148,11 @@
}
}

, isHTML: function(text) {
// html string detection logic adapted from jQuery
return typeof text != 'string'
|| ( text.charAt(0) === "<"
&& text.charAt( text.length - 1 ) === ">"
&& text.length >= 3
) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
}

, setContent: function () {
var $tip = this.tip()
, title = this.getTitle()

$tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
$tip.removeClass('fade in top bottom left right')
}

Expand Down Expand Up @@ -270,6 +261,7 @@
, trigger: 'hover'
, title: ''
, delay: 0
, html: true
}

}(window.jQuery);
16 changes: 4 additions & 12 deletions docs/assets/js/bootstrap.js
View file
Expand Up @@ -1092,20 +1092,11 @@
}
}

, isHTML: function(text) {
// html string detection logic adapted from jQuery
return typeof text != 'string'
|| ( text.charAt(0) === "<"
&& text.charAt( text.length - 1 ) === ">"
&& text.length >= 3
) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
}

, setContent: function () {
var $tip = this.tip()
, title = this.getTitle()

$tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
$tip.removeClass('fade in top bottom left right')
}

Expand Down Expand Up @@ -1214,6 +1205,7 @@
, trigger: 'hover'
, title: ''
, delay: 0
, html: true
}

}(window.jQuery);
Expand Down Expand Up @@ -1262,8 +1254,8 @@
, title = this.getTitle()
, content = this.getContent()

$tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
$tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)

$tip.removeClass('fade top bottom left right in')
}
Expand Down
2 changes: 1 addition & 1 deletion docs/assets/js/bootstrap.min.js
View file

Large diffs are not rendered by default.

12 changes: 12 additions & 0 deletions docs/javascript.html
View file
Expand Up @@ -771,6 +771,12 @@ <h3>Options</h3>
<td>true</td>
<td>apply a css fade transition to the tooltip</td>
</tr>
<tr>
<td>html</td>
<td>boolean</td>
<td>true</td>
<td>Insert html into the tooltip. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.</td>
</tr>
<tr>
<td>placement</td>
<td>string|function</td>
Expand Down Expand Up @@ -874,6 +880,12 @@ <h3>Options</h3>
<td>true</td>
<td>apply a css fade transition to the tooltip</td>
</tr>
<tr>
<td>html</td>
<td>boolean</td>
<td>true</td>
<td>Insert html into the tooltip. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.</td>
</tr>
<tr>
<td>placement</td>
<td>string|function</td>
Expand Down
12 changes: 12 additions & 0 deletions docs/templates/pages/javascript.mustache
View file
Expand Up @@ -693,6 +693,12 @@ $('a[data-toggle="tab"]').on('shown', function (e) {
<td>true</td>
<td>{{_i}}apply a css fade transition to the tooltip{{/i}}</td>
</tr>
<tr>
<td>{{_i}}html{{/i}}</td>
<td>{{_i}}boolean{{/i}}</td>
<td>true</td>
<td>{{_i}}Insert html into the tooltip. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.{{/i}}</td>
</tr>
<tr>
<td>{{_i}}placement{{/i}}</td>
<td>{{_i}}string|function{{/i}}</td>
Expand Down Expand Up @@ -796,6 +802,12 @@ $('a[data-toggle="tab"]').on('shown', function (e) {
<td>true</td>
<td>{{_i}}apply a css fade transition to the tooltip{{/i}}</td>
</tr>
<tr>
<td>{{_i}}html{{/i}}</td>
<td>{{_i}}boolean{{/i}}</td>
<td>true</td>
<td>{{_i}}Insert html into the popover. If false, jquery's <code>text</code> method will be used to insert content into the dom. Use text if you're worried about XSS attacks.{{/i}}</td>
</tr>
<tr>
<td>{{_i}}placement{{/i}}</td>
<td>{{_i}}string|function{{/i}}</td>
Expand Down
4 changes: 2 additions & 2 deletions js/bootstrap-popover.js
View file
Expand Up @@ -43,8 +43,8 @@
, title = this.getTitle()
, content = this.getContent()

$tip.find('.popover-title')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.isHTML(content) ? 'html' : 'text'](content)
$tip.find('.popover-title')[this.options.html ? 'html' : 'text'](title)
$tip.find('.popover-content > *')[this.options.html ? 'html' : 'text'](content)

$tip.removeClass('fade top bottom left right in')
}
Expand Down
12 changes: 2 additions & 10 deletions js/bootstrap-tooltip.js
View file
Expand Up @@ -148,20 +148,11 @@
}
}

, isHTML: function(text) {
// html string detection logic adapted from jQuery
return typeof text != 'string'
|| ( text.charAt(0) === "<"
&& text.charAt( text.length - 1 ) === ">"
&& text.length >= 3
) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
}

, setContent: function () {
var $tip = this.tip()
, title = this.getTitle()

$tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title)
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
$tip.removeClass('fade in top bottom left right')
}

Expand Down Expand Up @@ -270,6 +261,7 @@
, trigger: 'hover'
, title: ''
, delay: 0
, html: true
}

}(window.jQuery);

0 comments on commit f836473

Please sign in to comment.