web: update or remove bundled jQuery (CVE-2020-11022, CVE-2020-11023)
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 2.1k
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 31
Description
The beets web plugin bundles jQuery 1.x at:
beetsplug/web/static/jquery.js
This version is affected by XSS vulnerabilities fixed in jQuery 3.5.0:
- CVE-2020-11022
- CVE-2020-11023
Suggested fix: replace the bundled copy with a symlink to the system
libjs-jquery package, following the pattern already used for backbone.js.
This aligns with Debian packaging best practices.
Reported via Debian Bug#1145366.
Reference: https://security-tracker.debian.org/tracker/CVE-2020-11022
Contributor guide
Research direction
Start with beetsplug/web/static/jquery.js and compare the existing backbone.js packaging pattern. Replace or remove the vulnerable bundled jQuery in line with the system libjs-jquery package, then verify that the web plugin still uses the packaged copy and that the Debian packaging requirements are satisfied.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- debian, javascript, jquery
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 74/100