fix(scrollspy): xss in target option

twbs · May 30, 2018 · 3229efc · 3229efc
1 parent 3ba1863
commit 3229efc
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/js/src/scrollspy.js b/js/src/scrollspy.js
@@ -115,7 +115,7 @@ const ScrollSpy = (($) => {
 
       this._scrollHeight = this._getScrollHeight()
 
-      const targets = $.makeArray($(this._selector))
+      const targets = $.makeArray(document.querySelectorAll(this._selector))
 
       targets
         .map((element) => {