BUI-select-xss cve-2018-8108

During a security test, this issue was discovered by chance.
BUI is a front-end framework used by many enterprises to build their own front-end applications.

Typically, we prevent XSS by treating all user input as untrusted, escaping it during output, and then passing it to the front-end page for display.
However, when BUI's select component renders this output, it re-escapes the already-escaped user input, causing the XSS payload to bypass the original security mechanism and execute.

The example in the attachment comes from a real-world case.

It can be seen that the data in the input tag with id "workGroupList" has already been escaped.
The BUI.use below, when using the select component, fetches the data from "workGroupList" and directly triggers the execution of our injected XSS payload.

You can try running it to see the result.