Skip to content

XSS issue #23

@manik-ushur

Description

@manik-ushur

I am using this dropdown with the following settings:
$(".city").dropdown(fullTextSearch: true, placeholder: "City", allowAdditions: true });

If I enter the following in the text box:

<script>alert('hello')</script>

the script is executed. Is there a way to disallow that.
I have downloaded the script from here: https://github.com/Semantic-Org/UI-Dropdown/blob/master/dropdown.min.js

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions