fix(collapse): xss in parent option

diff --git a/js/src/collapse.js b/js/src/collapse.js
index a756542273fb7328ce2253447783218d02f91bfe..2c48cf545205a13954abe2db2abb28ef71d8d4ed 100644 (file)
--- a/js/src/collapse.js
+++ b/js/src/collapse.js
@@ -289,7 +289,7 @@ const Collapse = (($) => {
           parent = this._config.parent[0]
         }
       } else {
-        parent = $(this._config.parent)[0]
+        parent = document.querySelector(this._config.parent)
       }
 
       const selector =

diff --git a/js/tests/visual/collapse.html b/js/tests/visual/collapse.html
index 3005920957de504f4706b57319ea20f7b664db9b..24698d764f123778f6e09369b66953a9a7fd2ba6 100644 (file)
--- a/js/tests/visual/collapse.html
+++ b/js/tests/visual/collapse.html
@@ -54,6 +54,20 @@
             </div>
           </div>
         </div>
+        <div class="card">
+          <div class="card-header" role="tab" id="headingFour">
+            <h5 class="mb-0">
+              <a class="collapsed" data-toggle="collapse" href="#collapseFour" aria-expanded="false" aria-controls="collapseFour">
+                Collapsible Group Item with XSS in data-parent
+              </a>
+            </h5>
+          </div>
+          <div id="collapseFour" class="collapse" data-parent="<img src=1 onerror=alert(123) />" role="tabpanel" aria-labelledby="headingFour">
+            <div class="card-body">
+              Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor, sunt aliqua put a bird on it squid single-origin coffee nulla assumenda shoreditch et. Nihil anim keffiyeh helvetica, craft beer labore wes anderson cred nesciunt sapiente ea proident. Ad vegan excepteur butcher vice lomo. Leggings occaecat craft beer farm-to-table, raw denim aesthetic synth nesciunt you probably haven't heard of them accusamus labore sustainable VHS.
+            </div>
+          </div>
+        </div>
       </div>
     </div>