fix(affix): XSS on target config

Fixes twbs#27045
don-spyker · Aug 10, 2018 · ae29b6a · ae29b6a
1 parent 5c71ecf
commit ae29b6a
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/js/affix.js b/js/affix.js
@@ -16,7 +16,9 @@
   var Affix = function (element, options) {
     this.options = $.extend({}, Affix.DEFAULTS, options)
 
-    this.$target = $(this.options.target)
+    var target = this.options.target === Affix.DEFAULTS.target ? $(this.options.target) : $(document).find(this.options.target)
+
+    this.$target = target
       .on('scroll.bs.affix.data-api', $.proxy(this.checkPosition, this))
       .on('click.bs.affix.data-api',  $.proxy(this.checkPositionWithEventLoop, this))