fix(tooltip): XSS on data-viewport attribute

Fixes twbs#27044
don-spyker · Aug 10, 2018 · 5c71ecf · 5c71ecf
1 parent 7cfc6a9
commit 5c71ecf
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/js/tooltip.js b/js/tooltip.js
@@ -51,7 +51,7 @@
     this.type      = type
     this.$element  = $(element)
     this.options   = this.getOptions(options)
-    this.$viewport = this.options.viewport && $($.isFunction(this.options.viewport) ? this.options.viewport.call(this, this.$element) : (this.options.viewport.selector || this.options.viewport))
+    this.$viewport = this.options.viewport && $(document).find($.isFunction(this.options.viewport) ? this.options.viewport.call(this, this.$element) : (this.options.viewport.selector || this.options.viewport))
     this.inState   = { click: false, hover: false, focus: false }
 
     if (this.$element[0] instanceof document.constructor && !this.options.selector) {