Upgrade jQuery past known vulnerabilities
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 423
- Forks
- 158
- PR merge metrics
- No merged PRs in 30d
Description
Thanks for Deform; lovely work!
An question/issue re the jQuery versuib and security:
- The current version of Deform (2.0.15) ships with
static/scripts/jquery-2.0.3.min.js. - The advice is to load this from
<head>tags of pages using Deform, as per https://docs.pylonsproject.org/projects/deform/en/2.0-branch/basics.html#serving-up-the-rendered-form. - However, jQuery 2.0.3 has known cross-site scripting vulnerabilities: https://snyk.io/vuln/npm:jquery and http://www.cvedetails.com/vulnerability-list/vendor_id-6538/Jquery.html.
This was pointed out to us by a penetration testing company. They note that the potential exploit methods are complex, but I'm afraid I don't know whether this is in effect a false positive or whether it is a real concern. However, on the assumption that they are right:
Could Deform ship with a more recent jQuery version? I note this is clearly not as simple as dropping in the current version (3.6.0 does not work)! Many thanks for thinking about this.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with static/scripts/jquery-2.0.3.min.js and the documented form-serving guidance in the Deform 2.0 documentation. Investigate which newer jQuery version remains compatible with Deform, noting that 3.6.0 does not work. Done means Deform ships a compatible version without the reported known vulnerabilities and its usage documentation remains accurate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, jquery
- Domain
- frontend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100