coreui / coreui-pro / 28760810335

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(Rating,RangeSlider,Calendar,DateRangePicker): close sanitize bypass via data attributes (#595)

_getConfig stripped sanitize/allowList/sanitizeFn from the element's data
attributes, but then called _mergeConfigObj(config, this._element), which
re-reads every data attribute and re-introduced them — so
data-coreui-sanitize="false" in markup re-enabled raw HTML injection.
Drop the element from the merge (as tooltip.js already does) so the strip
sticks; JS-supplied config still overrides.

Coverage Stats

2790 of 3078 branches covered (90.64%)

Branch coverage included in aggregate %.

4 of 4 new or added lines in 4 files covered. (100.0%)

1 existing line in 1 file now uncovered.

7178 of 7453 relevant lines covered (96.31%)

766.27 hits per line