Since the switch to Bootstrap v4 has a potentially breaking impact on the software, this will not be done for LimeSurvey version 3 or 4, but rather for LimeSurvey version 5, planned for 2020.

The mentioned XSS vulnerabilities are all dependent on an injection of code into specific target attributes on HTML-elements and thus very hard to do for non-administrative users in LimeSurvey.
For any of the mentioned vulnerabilities you can create an actual exploit for, we will work on fixing them accordingly. If necessary with an addition to core Bootstrap, or jQuery.

@markusfluer : https://github.com/twbs/bootstrap/releases/tag/v3.4.1
Have the fix, the update can be done without broke BS compatibility

Security: Fixed an XSS vulnerability (CVE-2019-8331) in our tooltip and popover plugins by implementing a new HTML sanitizer

Markus quit mantis

This has already been like this since Aug 2019:
https://github.com/LimeSurvey/LimeSurvey/commit/a85ec977be0bce3433dc1363dde5ee65e34fce82

No

[shnoulle@poledra 3LTS]$ grep -r "Bootstrap v3" *
application/extensions/bootstrap/js/bootstrap.min.js: * Bootstrap v3.3.5 (http://getbootstrap.com)
application/extensions/bootstrap/js/bootstrap.js: * Bootstrap v3.3.5 (http://getbootstrap.com)

Else : all variations are from 3.3.7 , but no security issue in CSS file.

I don't think those files are actually being used.
That's part of the yiistrap extenson, whicch provides helpers as TbHtml.
That helper is used a lot, but only the php part, not the rest.

I have tried chaging the name of those files, and no error appeared.
(I haven't tested the whole system).

Suggested approach: Create a PR based on dev where we remove those files.
Check what's the outcome.

What do you think?

Suggested approach: Create a PR based on dev where we remove those files.

:+1:

Maybe in 3lts too ?

And a mini update on extensions/bootstrap to remove all registerScriptFile ?

https://github.com/LimeSurvey/LimeSurvey/pull/1798 for lts

Works fine. PR merged into LTS.

Fix committed to 3.x-LTS branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=31326

Honestly, this was a test as to double check if those removed files are used or not.
Not sure if it is the best to remove those files.

If removing them is fine, then we should review also on LS4.
Looking forward on your comments and directions.

Fixed in Release 3.25.18+210316