{"action":"created","issue":{"url":"https://api.github.com/repos/infor-design/enterprise-ng/issues/503","repository_url":"https://api.github.com/repos/infor-design/enterprise-ng","labels_url":"https://api.github.com/repos/infor-design/enterprise-ng/issues/503/labels{/name}","comments_url":"https://api.github.com/repos/infor-design/enterprise-ng/issues/503/comments","events_url":"https://api.github.com/repos/infor-design/enterprise-ng/issues/503/events","html_url":"https://github.com/infor-design/enterprise-ng/issues/503","id":448892079,"node_id":"MDU6SXNzdWU0NDg4OTIwNzk=","number":503,"title":"XSS in soho-dropdown","user":{"login":"anhallbe","id":4991954,"node_id":"MDQ6VXNlcjQ5OTE5NTQ=","avatar_url":"https://avatars2.githubusercontent.com/u/4991954?v=4","gravatar_id":"","url":"https://api.github.com/users/anhallbe","html_url":"https://github.com/anhallbe","followers_url":"https://api.github.com/users/anhallbe/followers","following_url":"https://api.github.com/users/anhallbe/following{/other_user}","gists_url":"https://api.github.com/users/anhallbe/gists{/gist_id}","starred_url":"https://api.github.com/users/anhallbe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anhallbe/subscriptions","organizations_url":"https://api.github.com/users/anhallbe/orgs","repos_url":"https://api.github.com/users/anhallbe/repos","events_url":"https://api.github.com/users/anhallbe/events{/privacy}","received_events_url":"https://api.github.com/users/anhallbe/received_events","type":"User","site_admin":false},"labels":[{"id":1009297063,"node_id":"MDU6TGFiZWwxMDA5Mjk3MDYz","url":"https://api.github.com/repos/infor-design/enterprise-ng/labels/[3]","name":"[3]","color":"d8d8d8","default":false},{"id":1150489977,"node_id":"MDU6TGFiZWwxMTUwNDg5OTc3","url":"https://api.github.com/repos/infor-design/enterprise-ng/labels/priority:%20high","name":"priority: high","color":"FF9426","default":false},{"id":926601740,"node_id":"MDU6TGFiZWw5MjY2MDE3NDA=","url":"https://api.github.com/repos/infor-design/enterprise-ng/labels/type:%20bug%20:bug:","name":"type: bug :bug:","color":"DACCEC","default":false},{"id":978408755,"node_id":"MDU6TGFiZWw5Nzg0MDg3NTU=","url":"https://api.github.com/repos/infor-design/enterprise-ng/labels/type:%20patch","name":"type: patch","color":"DACCEC","default":false}],"state":"closed","locked":false,"assignee":{"login":"tmcconechy","id":814283,"node_id":"MDQ6VXNlcjgxNDI4Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/814283?v=4","gravatar_id":"","url":"https://api.github.com/users/tmcconechy","html_url":"https://github.com/tmcconechy","followers_url":"https://api.github.com/users/tmcconechy/followers","following_url":"https://api.github.com/users/tmcconechy/following{/other_user}","gists_url":"https://api.github.com/users/tmcconechy/gists{/gist_id}","starred_url":"https://api.github.com/users/tmcconechy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tmcconechy/subscriptions","organizations_url":"https://api.github.com/users/tmcconechy/orgs","repos_url":"https://api.github.com/users/tmcconechy/repos","events_url":"https://api.github.com/users/tmcconechy/events{/privacy}","received_events_url":"https://api.github.com/users/tmcconechy/received_events","type":"User","site_admin":false},"assignees":[{"login":"tmcconechy","id":814283,"node_id":"MDQ6VXNlcjgxNDI4Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/814283?v=4","gravatar_id":"","url":"https://api.github.com/users/tmcconechy","html_url":"https://github.com/tmcconechy","followers_url":"https://api.github.com/users/tmcconechy/followers","following_url":"https://api.github.com/users/tmcconechy/following{/other_user}","gists_url":"https://api.github.com/users/tmcconechy/gists{/gist_id}","starred_url":"https://api.github.com/users/tmcconechy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tmcconechy/subscriptions","organizations_url":"https://api.github.com/users/tmcconechy/orgs","repos_url":"https://api.github.com/users/tmcconechy/repos","events_url":"https://api.github.com/users/tmcconechy/events{/privacy}","received_events_url":"https://api.github.com/users/tmcconechy/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2019-05-27T14:40:19Z","updated_at":"2019-06-19T09:20:02Z","closed_at":"2019-06-10T20:38:57Z","author_association":"CONTRIBUTOR","body":"**Describe the bug**\r\nClicking an entry with a <script> tag in a dropdown causes the script to execute. This only seem to happen when using `ids-enterprise-ng@5.2.1` and `ids-enterprise@4.18.1`.\r\n\r\n**To Reproduce**\r\nGiven the followin component:\r\n```html\r\n<select soho-dropdown [(ngModel)]=\"selected\">\r\n  <option *ngFor=\"let option of options\" [value]=\"option\">{{option}}</option>\r\n</select>\r\n```\r\n```typescript\r\n@Component({\r\n  selector: 'app-dropdown-xss',\r\n  templateUrl: './dropdown-xss.component.html',\r\n  styleUrls: ['./dropdown-xss.component.css']\r\n})\r\nexport class DropdownXssComponent {\r\n  selected = 'Hello';\r\n  options = [\r\n    'Hello',\r\n    `<script>window.alert('dropdown xss')</script>XSS`,\r\n    'World',\r\n  ];\r\n}\r\n```\r\nSteps to reproduce the behavior:\r\n1. Open the dropdown\r\n2. Click the entry with XSS\r\n3. Script executes\r\n\r\n**Expected behavior**\r\nThe script should not execute.\r\n\r\n**Version**\r\n- ids-enterprise-ng: 5.2.1\r\n- ids-enterprise: 4.18.1\r\n\r\n**Platform**\r\n Tested in Chrome on Windows.\r\n\r\n**Additional context**\r\nThis only happens when `ids-enterprise@4.18.1` is installed, i.e not the bundled 4.17.1.\r\nThere might be other XSS vulnerabilities in 4.18.1, since I managed to get the script to execute again when it was bound with `ngModel` to an `<input>`.\r\n"},"comment":{"url":"https://api.github.com/repos/infor-design/enterprise-ng/issues/comments/503480022","html_url":"https://github.com/infor-design/enterprise-ng/issues/503#issuecomment-503480022","issue_url":"https://api.github.com/repos/infor-design/enterprise-ng/issues/503","id":503480022,"node_id":"MDEyOklzc3VlQ29tbWVudDUwMzQ4MDAyMg==","user":{"login":"janahintal","id":45757016,"node_id":"MDQ6VXNlcjQ1NzU3MDE2","avatar_url":"https://avatars3.githubusercontent.com/u/45757016?v=4","gravatar_id":"","url":"https://api.github.com/users/janahintal","html_url":"https://github.com/janahintal","followers_url":"https://api.github.com/users/janahintal/followers","following_url":"https://api.github.com/users/janahintal/following{/other_user}","gists_url":"https://api.github.com/users/janahintal/gists{/gist_id}","starred_url":"https://api.github.com/users/janahintal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/janahintal/subscriptions","organizations_url":"https://api.github.com/users/janahintal/orgs","repos_url":"https://api.github.com/users/janahintal/repos","events_url":"https://api.github.com/users/janahintal/events{/privacy}","received_events_url":"https://api.github.com/users/janahintal/received_events","type":"User","site_admin":false},"created_at":"2019-06-19T09:20:02Z","updated_at":"2019-06-19T09:20:02Z","author_association":"NONE","body":"QA Passed. Will move to Done.\r\nTested in: \r\nhttps://master-enterprise.demo.design.infor.com/components/modal/test-xss.html\r\nhttps://master-enterprise.demo.design.infor.com/components/dropdown/test-xss.html\r\nhttps://master-enterprise.demo.design.infor.com/components/autocomplete/test-xss-security.html"}}
{"actor":{"display_login":"janahintal"}}