From cb4efc22b27c68e9b9d1b11e0e56a8f00977a219 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?BJ=C3=B6rm?= Date: Sun, 26 Jul 2026 04:10:53 +0700 Subject: [PATCH] fix: Improve target option processing in js.js MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Refactor target option handling to avoid HTML parsing. fix is to avoid passing potentially untrusted values directly to `$()` in the fallback branch. Keep selector strings handled via `$(document).find(...)`, and for non-string values only pass through safe object types (DOM node, window/document, jQuery object, event target). If an unexpected value is provided, resolve to an empty jQuery set instead of invoking `$()` on it. In `core/js/js.js`, update the `target` initialization around lines 2669–2672. Replace the current ternary with a small IIFE that: - uses `$( document ).find( options.of )` for string selectors, - uses `options.of.target` for event objects (if present), - accepts jQuery objects and DOM-like objects directly, - otherwise returns `$()`. --- core/js/js.js | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/core/js/js.js b/core/js/js.js index e8c51a37b60a..ba8e15970237 100644 --- a/core/js/js.js +++ b/core/js/js.js @@ -2666,10 +2666,19 @@ $.fn.position = function( options ) { var atOffset, targetWidth, targetHeight, targetOffset, basePosition, dimensions, - // Make sure string options are treated as CSS selectors - target = typeof options.of === "string" ? - $( document ).find( options.of ) : - $( options.of ), + // Make sure string options are treated as CSS selectors and avoid HTML parsing + target = ( function( of ) { + if ( typeof of === "string" ) { + return $( document ).find( of ); + } + if ( of && of.target ) { + return $( of.target ); + } + if ( of && ( of.jquery || of.nodeType || of === window || of === document ) ) { + return $( of ); + } + return $(); + } )( options.of ), within = $.position.getWithinInfo( options.within ), scrollInfo = $.position.getScrollInfo( within ),