Closed
Conversation
|
|
Apply gh-2432 ajaxConvert guard from jquery/jquery@2546bb35 so the bundled test copy matches the upstream XSS mitigation. Add a small bash regression check for CI/local use. Refs: jquery/jquery@2546bb3
navnitan-7
force-pushed
the
fix/cve-2015-9251-test-jquery-fixture
branch
from
d9562a3 to
a6bbbf0
Compare
Member
|
Thank you for your contribution. However, the CVE listed was fixed in jQuery version 3.0.0, as it says. The vulnerability does not exist in 3.7.1. The patch is in a prefilter, which happens earlier. If you think you've discovered a new vulnerability, please have a look at https://github.com/jquery/jquery-migrate/security/policy and report it privately. |
timmywil
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Align the bundled test copy
test/data/jquery-3.7.1.jswith the jQuery core XSS mitigation for CVE-2015-9251 / gh-2432 by adding the sameajaxConvertguard as upstream:jquery/jquery@2546bb35.Changes
if ( s.crossDomain && current === "script" ) { continue; }inajaxConvertbefore converter lookup.scripts/verify-jquery-cve-2015-9251.shto grep for the guard (local/CI helper).Reproduction (before)
The fixture file had no
s.crossDomain && current === "script"branch insideajaxConvert’sprev !== "*" && prev !== currentblock (vulnerable pattern relative to gh-2432).Verification
bash scripts/verify-jquery-cve-2015-9251.sh→ oknpm run build:all && npm run lint && npm run test:browserless→ passnpm run test:unit -- -b chrome --headless→ 67 passednpm run test:esm→ 67 passed, 3 skippedNote: Full
npm test(Chrome + Firefox headless) was not completed locally because the Firefox WebDriver failed to install on this machine (selenium-manager/ geckodriver). Upstream CI should cover Firefox if applicable.Scope
Two files: test fixture jQuery copy + small regression script; no changes to migrate library source.
Made with Cursor