Skip to content

Commit 728884b

Browse files
committed
✨ add jQuery Security info to README
1 parent bf11739 commit 728884b

File tree

1 file changed

+3
-382
lines changed

1 file changed

+3
-382
lines changed

README.md

Lines changed: 3 additions & 382 deletions
Original file line numberDiff line numberDiff line change
@@ -1,384 +1,5 @@
1-
[jQuery](https://jquery.com/) — New Wave JavaScript
2-
==================================================
1+
# EOL jQuery versions with security patches
32

4-
Meetings are currently held on the [matrix.org platform](https://matrix.to/#/#jquery_meeting:gitter.im).
3+
This repository contains unofficial end-of-life jQuery versions with vulnerabilities patched.
54

6-
Meeting minutes can be found at [meetings.jquery.org](https://meetings.jquery.org/category/core/).
7-
8-
Contribution Guides
9-
--------------------------------------
10-
11-
In the spirit of open source software development, jQuery always encourages community code contribution. To help you get started and before you jump into writing code, be sure to read these important contribution guidelines thoroughly:
12-
13-
1. [Getting Involved](https://contribute.jquery.org/)
14-
2. [Core Style Guide](https://contribute.jquery.org/style-guide/js/)
15-
3. [Writing Code for jQuery Projects](https://contribute.jquery.org/code/)
16-
17-
### References to issues/PRs
18-
19-
GitHub issues/PRs are usually referenced via `gh-NUMBER`, where `NUMBER` is the numerical ID of the issue/PR. You can find such an issue/PR under `https://github.com/jquery/jquery/issues/NUMBER`.
20-
21-
jQuery has used a different bug tracker - based on Trac - in the past, available under [bugs.jquery.com](https://bugs.jquery.com/). It is being kept in read only mode so that referring to past discussions is possible. When jQuery source references one of those issues, it uses the pattern `trac-NUMBER`, where `NUMBER` is the numerical ID of the issue. You can find such an issue under `https://bugs.jquery.com/ticket/NUMBER`.
22-
23-
24-
Environments in which to use jQuery
25-
--------------------------------------
26-
27-
- [Browser support](https://jquery.com/browser-support/)
28-
- jQuery also supports Node, browser extensions, and other non-browser environments.
29-
30-
31-
What you need to build your own jQuery
32-
--------------------------------------
33-
34-
To build jQuery, you need to have the latest Node.js/npm and git 1.7 or later. Earlier versions might work, but are not supported.
35-
36-
For Windows, you have to download and install [git](https://git-scm.com/downloads) and [Node.js](https://nodejs.org/en/download/).
37-
38-
macOS users should install [Homebrew](https://brew.sh/). Once Homebrew is installed, run `brew install git` to install git,
39-
and `brew install node` to install Node.js.
40-
41-
Linux/BSD users should use their appropriate package managers to install git and Node.js, or build from source
42-
if you swing that way. Easy-peasy.
43-
44-
45-
How to build your own jQuery
46-
----------------------------
47-
48-
First, [clone the jQuery git repo](https://help.github.com/en/github/creating-cloning-and-archiving-repositories/cloning-a-repository).
49-
50-
Then, enter the jquery directory, install dependencies, and run the build script:
51-
52-
```bash
53-
cd jquery
54-
npm install
55-
npm run build
56-
```
57-
58-
The built version of jQuery will be placed in the `dist/` directory, along with a minified copy and associated map file.
59-
60-
## Build all jQuery release files
61-
62-
To build all variants of jQuery, run the following command:
63-
64-
```bash
65-
npm run build:all
66-
```
67-
68-
This will create all of the variants that jQuery includes in a release, including `jquery.js`, `jquery.slim.js`, `jquery.module.js`, and `jquery.slim.module.js` along their associated minified files and sourcemaps.
69-
70-
`jquery.module.js` and `jquery.slim.module.js` are [ECMAScript modules](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules) that export `jQuery` and `$` as named exports are placed in the `dist-module/` directory rather than the `dist/` directory.
71-
72-
## Building a Custom jQuery
73-
74-
The build script can be used to create a custom version of jQuery that includes only the modules you need.
75-
76-
Any module may be excluded except for `core`. When excluding `selector`, it is not removed but replaced with a small wrapper around native `querySelectorAll` (see below for more information).
77-
78-
### Build Script Help
79-
80-
To see the full list of available options for the build script, run the following:
81-
82-
```bash
83-
npm run build -- --help
84-
```
85-
86-
### Modules
87-
88-
To exclude a module, pass its path relative to the `src` folder (without the `.js` extension) to the `--exclude` option. When using the `--include` option, the default includes are dropped and a build is created with only those modules.
89-
90-
Some example modules that can be excluded or included are:
91-
92-
- **ajax**: All AJAX functionality: `$.ajax()`, `$.get()`, `$.post()`, `$.ajaxSetup()`, `.load()`, transports, and ajax event shorthands such as `.ajaxStart()`.
93-
- **ajax/xhr**: The XMLHTTPRequest AJAX transport only.
94-
- **ajax/script**: The `<script>` AJAX transport only; used to retrieve scripts.
95-
- **ajax/jsonp**: The JSONP AJAX transport only; depends on the ajax/script transport.
96-
- **css**: The `.css()` method. Also removes **all** modules depending on css (including **effects**, **dimensions**, and **offset**).
97-
- **css/showHide**: Non-animated `.show()`, `.hide()` and `.toggle()`; can be excluded if you use classes or explicit `.css()` calls to set the `display` property. Also removes the **effects** module.
98-
- **deprecated**: Methods documented as deprecated but not yet removed.
99-
- **dimensions**: The `.width()` and `.height()` methods, including `inner-` and `outer-` variations.
100-
- **effects**: The `.animate()` method and its shorthands such as `.slideUp()` or `.hide("slow")`.
101-
- **event**: The `.on()` and `.off()` methods and all event functionality.
102-
- **event/trigger**: The `.trigger()` and `.triggerHandler()` methods.
103-
- **offset**: The `.offset()`, `.position()`, `.offsetParent()`, `.scrollLeft()`, and `.scrollTop()` methods.
104-
- **wrap**: The `.wrap()`, `.wrapAll()`, `.wrapInner()`, and `.unwrap()` methods.
105-
- **core/ready**: Exclude the ready module if you place your scripts at the end of the body. Any ready callbacks bound with `jQuery()` will simply be called immediately. However, `jQuery(document).ready()` will not be a function and `.on("ready", ...)` or similar will not be triggered.
106-
- **deferred**: Exclude jQuery.Deferred. This also excludes all modules that rely on Deferred, including **ajax**, **effects**, and **queue**, but replaces **core/ready** with **core/ready-no-deferred**.
107-
- **exports/global**: Exclude the attachment of global jQuery variables ($ and jQuery) to the window.
108-
- **exports/amd**: Exclude the AMD definition.
109-
110-
- **selector**: The full jQuery selector engine. When this module is excluded, it is replaced with a rudimentary selector engine based on the browser's `querySelectorAll` method that does not support jQuery selector extensions or enhanced semantics. See the [selector-native.js](https://github.com/jquery/jquery/blob/main/src/selector-native.js) file for details.
111-
112-
*Note*: Excluding the full `selector` module will also exclude all jQuery selector extensions (such as `effects/animatedSelector` and `css/hiddenVisibleSelectors`).
113-
114-
##### AMD name
115-
116-
You can set the module name for jQuery's AMD definition. By default, it is set to "jquery", which plays nicely with plugins and third-party libraries, but there may be cases where you'd like to change this. Pass it to the `--amd` parameter:
117-
118-
```bash
119-
npm run build -- --amd="custom-name"
120-
```
121-
122-
Or, to define anonymously, leave the name blank.
123-
124-
```bash
125-
npm run build -- --amd
126-
```
127-
128-
##### File name and directory
129-
130-
The default name for the built jQuery file is `jquery.js`; it is placed under the `dist/` directory. It's possible to change the file name using `--filename` and the directory using `--dir`. `--dir` is relative to the project root.
131-
132-
```bash
133-
npm run build -- --slim --filename="jquery.slim.js" --dir="/tmp"
134-
```
135-
136-
This would create a slim version of jQuery and place it under `tmp/jquery.slim.js`.
137-
138-
##### ECMAScript Module (ESM) mode
139-
140-
By default, jQuery generates a regular script JavaScript file. You can also generate an ECMAScript module exporting `jQuery` as the default export using the `--esm` parameter:
141-
142-
```bash
143-
npm run build -- --filename=jquery.module.js --esm
144-
```
145-
146-
##### Factory mode
147-
148-
By default, jQuery depends on a global `window`. For environments that don't have one, you can generate a factory build that exposes a function accepting `window` as a parameter that you can provide externally (see [`README` of the published package](build/fixtures/README.md) for usage instructions). You can generate such a factory using the `--factory` parameter:
149-
150-
```bash
151-
npm run build -- --filename=jquery.factory.js --factory
152-
```
153-
154-
This option can be mixed with others like `--esm` or `--slim`:
155-
156-
```bash
157-
npm run build -- --filename=jquery.factory.slim.module.js --factory --esm --slim --dir="/dist-module"
158-
```
159-
160-
#### Custom Build Examples
161-
162-
Create a custom build using `npm run build`, listing the modules to be excluded. Excluding a top-level module also excludes its corresponding directory of modules.
163-
164-
Exclude all **ajax** functionality:
165-
166-
```bash
167-
npm run build -- --exclude=ajax
168-
```
169-
170-
Excluding **css** removes modules depending on CSS: **effects**, **offset**, **dimensions**.
171-
172-
```bash
173-
npm run build -- --exclude=css
174-
```
175-
176-
Exclude a bunch of modules (`-e` is an alias for `--exclude`):
177-
178-
```bash
179-
npm run build -- -e ajax/jsonp -e css -e deprecated -e dimensions -e effects -e offset -e wrap
180-
```
181-
182-
There is a special alias to generate a build with the same configuration as the official jQuery Slim build:
183-
184-
```bash
185-
npm run build -- --filename=jquery.slim.js --slim
186-
```
187-
188-
Or, to create the slim build as an esm module:
189-
190-
```bash
191-
npm run build -- --filename=jquery.slim.module.js --slim --esm
192-
```
193-
194-
*Non-official custom builds are not regularly tested. Use them at your own risk.*
195-
196-
Running the Unit Tests
197-
--------------------------------------
198-
199-
Make sure you have the necessary dependencies:
200-
201-
```bash
202-
npm install
203-
```
204-
205-
Start `npm start` to auto-build jQuery as you work:
206-
207-
```bash
208-
npm start
209-
```
210-
211-
212-
Run the unit tests with a local server that supports PHP. Ensure that you run the site from the root directory, not the "test" directory. No database is required. Pre-configured php local servers are available for Windows and Mac. Here are some options:
213-
214-
- Windows: [WAMP download](http://www.wampserver.com/en/)
215-
- Mac: [MAMP download](https://www.mamp.info/en/downloads/)
216-
- Linux: [Setting up LAMP](https://www.linux.com/training-tutorials/easy-lamp-server-installation/)
217-
- [Mongoose (most platforms)](https://code.google.com/p/mongoose/)
218-
219-
220-
221-
Essential Git
222-
-------------
223-
224-
As the source code is handled by the Git version control system, it's useful to know some features used.
225-
226-
### Cleaning ###
227-
228-
If you want to purge your working directory back to the status of upstream, the following commands can be used (remember everything you've worked on is gone after these):
229-
230-
```bash
231-
git reset --hard upstream/main
232-
git clean -fdx
233-
```
234-
235-
### Rebasing ###
236-
237-
For feature/topic branches, you should always use the `--rebase` flag to `git pull`, or if you are usually handling many temporary "to be in a github pull request" branches, run the following to automate this:
238-
239-
```bash
240-
git config branch.autosetuprebase local
241-
```
242-
(see `man git-config` for more information)
243-
244-
### Handling merge conflicts ###
245-
246-
If you're getting merge conflicts when merging, instead of editing the conflicted files manually, you can use the feature
247-
`git mergetool`. Even though the default tool `xxdiff` looks awful/old, it's rather useful.
248-
249-
The following are some commands that can be used there:
250-
251-
* `Ctrl + Alt + M` - automerge as much as possible
252-
* `b` - jump to next merge conflict
253-
* `s` - change the order of the conflicted lines
254-
* `u` - undo a merge
255-
* `left mouse button` - mark a block to be the winner
256-
* `middle mouse button` - mark a line to be the winner
257-
* `Ctrl + S` - save
258-
* `Ctrl + Q` - quit
259-
260-
[QUnit](https://api.qunitjs.com) Reference
261-
-----------------
262-
263-
### Test methods ###
264-
265-
```js
266-
expect( numAssertions );
267-
stop();
268-
start();
269-
```
270-
271-
272-
*Note*: QUnit's eventual addition of an argument to stop/start is ignored in this test suite so that start and stop can be passed as callbacks without worrying about their parameters.
273-
274-
### Test assertions ###
275-
276-
277-
```js
278-
ok( value, [message] );
279-
equal( actual, expected, [message] );
280-
notEqual( actual, expected, [message] );
281-
deepEqual( actual, expected, [message] );
282-
notDeepEqual( actual, expected, [message] );
283-
strictEqual( actual, expected, [message] );
284-
notStrictEqual( actual, expected, [message] );
285-
throws( block, [expected], [message] );
286-
```
287-
288-
289-
Test Suite Convenience Methods Reference (See [test/data/testinit.js](https://github.com/jquery/jquery/blob/main/test/data/testinit.js))
290-
------------------------------
291-
292-
### Returns an array of elements with the given IDs ###
293-
294-
```js
295-
q( ... );
296-
```
297-
298-
Example:
299-
300-
```js
301-
q("main", "foo", "bar");
302-
303-
=> [ div#main, span#foo, input#bar ]
304-
```
305-
306-
### Asserts that a selection matches the given IDs ###
307-
308-
```js
309-
t( testName, selector, [ "array", "of", "ids" ] );
310-
```
311-
312-
Example:
313-
314-
```js
315-
t("Check for something", "//[a]", ["foo", "bar"]);
316-
```
317-
318-
319-
320-
### Fires a native DOM event without going through jQuery ###
321-
322-
```js
323-
fireNative( node, eventType )
324-
```
325-
326-
Example:
327-
328-
```js
329-
fireNative( jQuery("#elem")[0], "click" );
330-
```
331-
332-
### Add random number to url to stop caching ###
333-
334-
```js
335-
url( "some/url" );
336-
```
337-
338-
Example:
339-
340-
```js
341-
url("index.html");
342-
343-
=> "data/index.html?10538358428943"
344-
345-
346-
url("mock.php?foo=bar");
347-
348-
=> "data/mock.php?foo=bar&10538358345554"
349-
```
350-
351-
352-
### Run tests in an iframe ###
353-
354-
Some tests may require a document other than the standard test fixture, and
355-
these can be run in a separate iframe. The actual test code and assertions
356-
remain in jQuery's main test files; only the minimal test fixture markup
357-
and setup code should be placed in the iframe file.
358-
359-
```js
360-
testIframe( testName, fileName,
361-
function testCallback(
362-
assert, jQuery, window, document,
363-
[ additional args ] ) {
364-
...
365-
} );
366-
```
367-
368-
This loads a page, constructing a url with fileName `"./data/" + fileName`.
369-
The iframed page determines when the callback occurs in the test by
370-
including the "/test/data/iframeTest.js" script and calling
371-
`startIframeTest( [ additional args ] )` when appropriate. Often this
372-
will be after either document ready or `window.onload` fires.
373-
374-
The `testCallback` receives the QUnit `assert` object created by `testIframe`
375-
for this test, followed by the global `jQuery`, `window`, and `document` from
376-
the iframe. If the iframe code passes any arguments to `startIframeTest`,
377-
they follow the `document` argument.
378-
379-
380-
Questions?
381-
----------
382-
383-
If you have any questions, please feel free to ask on the
384-
[Developing jQuery Core forum](https://forum.jquery.com/developing-jquery-core) or in #jquery on [libera](https://web.libera.chat/).
5+
See [jQuery-security](https://github.com/ctcpip/jquery-security) for more information.

0 commit comments

Comments
 (0)