Q:

In Login page of web application, I have allowed drag and drop of any text. Is it vulnerable to XSS attack?

Will I need to add any attribute to restrict drag and drop of any file?

A:

An XSS attack is performed by injecting malicious code to be displayed to another user.  
To use a standard login form for an XSS attack, you would need the malicious code to be in the username - the only thing likely to be shown to other users.
But how the username-with-malicious payload got in there isn't relevant, so it is not inherent to the fact that you use drag-and-drop. 
Allowing a username that consists of a large amount of text (for example, the contents of a file) would make it easier to perform this type of XSS attack in a username. So you'll want to check the username against it.
That being said, usernames are often limited in the length they're allowed to have. This makes them unlikely attack vectors. If you're running some kind of forum, users signature lines and forum posts are more likely places to contain an XSS attack.

