We use jQuery together with angularjs templates.

One of our templates has the following HTML

  <div>
    <p>Start of our template</p>
    <!-- <qrcode target-url="appTo.mobileCodeUrl" title="Loading QR code..." /> -->
    <p>End of our template</p>
  </div>

After updating to Drupal 7.70 (security issue sa-core-2020-002), when we append the inner HTML of the <div> to the DOM, the contents get filtered out, due to the <qrcode>.

I tried to create a test case on https://jsbin.com/zemoret/6/edit?html,js,output (please have a look at the console output).

Nevertheless, as this 'unsafe' tag resides inside an HTML comment, it is unharmful.

Comments

koosvdkolk created an issue. See original summary.

jvdkolk’s picture

jvdkolk commented
Title: jQuery false positive unsafe tags » jQuery false positive unsafe tags inside comments
jvdkolk’s picture

jvdkolk commented
Issue summary: View changes

Status: Active » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.