jquery-form / jquery-form/form
Fortify SCA: Code Injection .
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 5.1k
- Forks
- 2.1k
- PR merge metrics
- No merged PRs in 30d
Description
Please review Instructions for Reporting a Bug.
Description:
I have no idea about whether it has been fixed in later versions. but the code scan is not passed.
Expected Behavior:
Actual behavior:
Source: jquery.form.js:812 Read xhr.responseXML()
810 var ct = xhr.getResponseHeader('content-type') || '',
811 xml = type === 'xml' || !type && ct.indexOf('xml') >= 0,
812 data = xml ? xhr.responseXML : xhr.responseText;
813
814 if (xml && data.documentElement.nodeName === 'parsererror') {
Sink: jquery.form.js:781 setTimeout() 779
780 // clean up
781 setTimeout(function() {
782 if (!s.iframeTarget) {
783 $io.remove();
Versions:
jqform:3.51
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review jquery.form.js around lines 781 and 812, then check the Fortify SCA report for the reported data flow. Compare the finding with the jqForm 3.51 behavior and any later version information available. Done means the reported Code Injection finding is resolved or clearly addressed and the scan passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, jquery
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100