alibaba / alibaba/Sentinel

Upgrade sentinel-dashboard's jQuery version

Open
#2,684 3 comments 0 reactions 0 assignees View on GitHub
area/dashboard dependencies
Dominant language
Java
Stars
23.1k
Forks
8.1k
PR merge metrics
No merged PRs in 30d

Description

## Issue Description

Type: bug report

### Describe what happened

Our application is using Sentinel and is currently undergoing penetration testing. The test scans out the vulnerability of the jQuery version is too low. Users are at risk of being targeted with XSS attacks.

### Describe what you expected to happen

Hope the community can upgrade the version of jQuery to 3.5.0 or later. Or you can tell us how to replace and upgrade the version ourselves.

### How to reproduce it

https://github.com/alibaba/Sentinel/blob/1.8.4/sentinel-dashboard/src/main/webapp/resources/lib/js/jquery.min.js

### Tell us your environment

- Operating env: K8S
- Sentinel version: 1.8.1.1

### Anything else we need to know?
Null

Contributor guide

Open the contributing guide

Research direction

Start with sentinel-dashboard/src/main/webapp/resources/lib/js/jquery.min.js, which the issue identifies as the vulnerable jQuery copy. Upgrade it to jQuery 3.5.0 or later and verify that the dashboard uses the new version and the reported vulnerability is no longer detected.

Written by the indexing model from the issue text.

Assessment

Tech stack
jquery
Domain
frontend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.