Fix XSS in data-target

[Johann-S]

Fix XSS in our data-target (CVE-2016-10735).

Closes #20184
/CC @meeque

[meeque]

What about js/dist/util.js will CI generate these?

Asking because I have started from writing failing unit tests, and they still fail unless I also fix it over there.

Fyi, you can find these tests here:
https://github.com/meeque/bootstrap/tree/topic/20184-xss-in-data-target-attribute
I've already merged your fix into that.

[Johann-S]

Yes Travis build our code and in this case update js/dist/util.js and only added a Visual test because when we fail to get a target they aren't any error so that's a bit difficult to test that with Travis and we don't have unit tests for util.js

Is it a correct fix for you ?

[meeque]

Yes, the fix looks fine.

I'll have a look around, and check if other features might be affected similarly. I'd open new issues in that case...

The qunit test that I wrote seem to work rather fine either way. Of course, for the positive case there is not much to check, so they just wait for a (very short) timeout, and assert that nothing has happened.

[Johann-S]

Maybe you can create a PR which target my branch v4-xss-data-attribute with your unit test ? ☺️

[Johann-S]

Thanks @meeque 👍