There is a security vulnerability regarding Bootstrap 3.3.7. It says that "Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) attacks via the data-target attribute." I am wondering if v3.3.7 is safe to use if the "data-target" attribute is not used.
1 Answers
The so called 'vulnerability' only occurs if the data-target value relies on data injected by something external (directly or indirectly) AND is shown on a page where other users than the attacker are affected.
In other words this is NOT an issue if all your data-target attributes are made of hardcoded html text. It is also generally not an issue if this page is only seen by the attacker (self-hack ...).
For example you could also say jQuery .html() is a vulnerability, which is a more obvious case, but still vulnerable to XSS if you are a total web beginner or just did not pay attention.
So in general, avoid injecting unescaped user data in third-party: popups, tool-tips, ... or anything where DOM is directly manipulated behind the scenes.
I personally do not consider this a big vulnerability, but it is nicer if a famous framework like bootstrap handles this case or explicitly names the method as unsafe to warn developers.
Chrome audit considers bootstrap 3.3.x a vulnerability (via synk):
Includes front-end JavaScript libraries with known security vulnerabilities
Related