fancyapps/fancyBox — Issue #131: fancybox 2.0.4 title xss?
Author: maindgit
Created: 2012-02-03 08:58:54+00:00
State: open

Hello!

I use fancybox 2.0.4 on my site, and there is a possibility for users to set picture titles by themselves.
I'm using std way to pass title to the fancybox - via "title" attribute of an tag.
Note, that all titles are escaped by me, when it is passing to "title" attribute (I'm using smarty |escape modifier).

Steps to reproduce:
- user inputed something like this ''
(we can simulate it in smarty just as {$xssTitle = ''})
- pass it to the fancybox's title *escaped* as:
...

Expected:
- fancybox will show it as a simple text (because it was escaped)

Results:
- alert is shown, which means that title was *unescaped* and used

As a solution, I used HTMLPurifier to strip danger tags in user values.
So, server side in my case is protecting fancybox from xss.
I guess that this behavior of fancybox is not right.
It shouldn't do automatical unescaping.

But, if that was done especially to allow html in titles - it should be documented.
Because developers like me, should do double escaping (which works too), or something like htmlpurifier validations.

Thanks.