ehynds/jquery-ui-multiselect-widget — Issue #229: xss attacks within the option values
Author: kogaion
Created: 2012-02-27 09:44:12+00:00
State: open

Hello,

I believe that, when updating the "buttonlabel" with the selected option value(s), the html must first be escaped to avoid xss-attacks within the option values, for instance like this:

$.ech.multiselect.prototype.update = function () {
var o = this.options, $inputs = this.labels.find("input"), $checked = $inputs.filter(":checked"), numChecked = $checked.length, value;
if (numChecked === 0) {
value = o.noneSelectedText;
} else {
if ($.isFunction(o.selectedText)) {
value = o.selectedText.call(this, numChecked, $inputs.length, $checked.get());
} else if (/\d/.test(o.selectedList) &&
o.selectedList > 0 && numChecked <= o.selectedList) {
// OLD, NOT ESCAPED
//value = $checked.map(function () {return this.title; }).get().join(", ");
// NEW, ESCAPED
value = $checked.map(function () {return $('<div />').text(this.title).html();}).get().join(", ");
// END OF CHANGES
} else {
value = o.selectedText.replace("#", numChecked).replace("#", $inputs.length);
}
}
this.buttonlabel.html(value);
return value;
};

Thank you.