Fix/xss issues on data attributes (#27047)

* fix(collapse): xss CVE-2018-14040

Fixes #26625

* fix(tooltip): xss CVE-2018-14042

Fixes #26628

* fix(tooltip): XSS on data-viewport attribute

Fixes #27044

* fix(affix): XSS on target config

Fixes #27045

js/tests/unit/affix.js

@@ -104,4 +104,19 @@ $(function () {
       }, 250)
     }, 250)
   })
+
+  QUnit.test('should raise exception to avoid xss on target', function (assert) {
+    assert.expect(1)
+    assert.throws(function () {
+
+      var templateHTML = '<div id="affixTarget"></div>'
+      $(templateHTML).appendTo(document.body)
+
+      $('#affixTarget').bootstrapAffix({
+        target: '<img src=1 onerror=\'alert(0)\'>'
+      })
+
+    },  new Error('Syntax error, unrecognized expression: <img src=1 onerror=\'alert(0)\'>'))
+  })
+
 })

js/tests/unit/collapse.js

@@ -440,4 +440,14 @@ $(function () {
       .bootstrapCollapse('show')
   })
 
+  QUnit.test('should raise exception to avoid xss on data-parent', function (assert) {
+    assert.expect(1)
+    assert.throws(function () {
+      $('<a role="button" data-toggle="collapse" data-parent="<img src=1 onerror=\'alert(0)\'>" href="#collapseThree">')
+        .appendTo('#qunit-fixture')
+        .bootstrapCollapse('show')
+        .trigger('click');
+    },  new Error('Syntax error, unrecognized expression: <img src=1 onerror=\'alert(0)\'>'))
+  })
+
 })

js/tests/unit/tooltip.js

@@ -1322,4 +1322,22 @@ $(function () {
     })
   })
 
+  QUnit.test('should raise exception to avoid xss on data-container', function (assert) {
+    assert.expect(1)
+    assert.throws(function () {
+      $('<button data-toggle="tooltip" data-container="<img src=1 onerror=\'alert(0)\'>" title="Tooltip on right">Tooltip on right</button>')
+        .appendTo('#qunit-fixture')
+        .bootstrapTooltip('show')
+    },  new Error('Syntax error, unrecognized expression: <img src=1 onerror=\'alert(0)\'>'))
+  })
+
+  QUnit.test('should raise exception to avoid xss on data-viewport', function (assert) {
+    assert.expect(1)
+    assert.throws(function () {
+      $('<button data-toggle="tooltip" data-viewport="<img src=1 onerror=\'alert(0)\'>" title="Tooltip on right">Tooltip on right</button>')
+        .appendTo('#qunit-fixture')
+        .bootstrapTooltip('show')
+    },  new Error('Syntax error, unrecognized expression: <img src=1 onerror=\'alert(0)\'>'))
+  })
+
 })