Autocomplete: XSS in combobox demo

[DJtomy]

Hello, I would like to report a XSS vulnerability that I've found on your site.

Adress: ​http://jqueryui.com/autocomplete/#combobox

Steps to follow:

1. enter in the textbox something like test><script>alert(document.cookie)</script>
2. Press the Show All Items button or the Show underlying select button.

You'll see that the script is executed, which means that the autocomplete module makes the website vulnerable.

Even if the vulnerability might be useless in it's current context, it is a bad example for other webmasters that will fall into creating insecured websites folowing the on-site example. That's why I should this should be repaired as soon as possible.

Cheers!

[Scott González]

Autocomplete demo: Combobox: Encode search term inside tooltips. Fixes #8859 - Autocomplete: XSS in combobox demo.

Changeset: 5fee6fd5000072ff32f2d65b6451f39af9e0e39e

[DJtomy]

Replying to Scott González:

Autocomplete demo: Combobox: Encode search term inside tooltips. Fixes #8859 - Autocomplete: XSS in combobox demo.

Changeset: 5fee6fd5000072ff32f2d65b6451f39af9e0e39e

Just tested again, it is not fixed! XSS still working.

[mikesherov]

DJTomy, the milestone is 1.10, which means it'll be fixed when that version is released.

[DJtomy]

Replying to mikesherov:

DJTomy, the milestone is 1.10, which means it'll be fixed when that version is released.

I understand, my bad! Sorry for the trouble!