Skip to content

Commit 18a990f

Browse files
ctcpipctcpip
committed
✨ initial add of 1.2.7-sec tests
1 parent a2ecba3 commit 18a990f

File tree

14 files changed

+4426
-4
lines changed

14 files changed

+4426
-4
lines changed

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ npm-debug.log*
2525
!/dist-module/jquery.node-module-wrapper.slim.js
2626

2727
/external
28-
/node_modules
28+
node_modules
2929

3030
/test/data/core/jquery-iterability-transpiled.js
3131
/test/data/qunit-fixture.js

‎README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ In a perfect world, at least every MAJOR EOL jQuery release line would have a se
3434

3535
| jQuery version | jQuery-sec version | Branch | PR | Release | CVEs Patched |
3636
| -------------- | ------------------ | ----------- | -------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------ |
37-
| `1.2.6` | `1.2.7-sec` | [1.2.7-sec] | [PR][1.2.7-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
37+
| `1.2.6` | `1.2.7-sec` | [1.2.7-sec] | [PR][1.2.7-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| <del>CVE-2015-9251</del>* \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
3838
| `1.3.2` | `1.3.3-sec` | | | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
3939
| `1.4.4` | `1.4.5-sec` | | | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
4040
| `1.5.2` | `1.5.3-sec` | | | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
@@ -44,6 +44,9 @@ In a perfect world, at least every MAJOR EOL jQuery release line would have a se
4444
| `1.12.4` | `1.12.5-sec` | | | | [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-11022] \| [CVE-2020-11023] |
4545
| `2.2.4` | `2.2.5-sec` | | | | [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-11022] \| [CVE-2020-11023] \| [CVE-2020-23064] |
4646

47+
> [!IMPORTANT]
48+
> *CVE-2015-9251 is not reproducible in `1.2.6`
49+
4750
> [!NOTE]
4851
> The 3.x release line is currently supported by jQuery, so we have no need to provide patched versions of 3.x at this time. jQuery 3.5 introduced a breaking change, but it was necessary to fix CVE-2020-11022 and CVE-2020-11023. However, since these vulnerabilities are present in virtually all versions of jQuery, there would be no value in providing a patched version of 3.4 as it would need to include that breaking change anyway.
4952

‎security/1.2.7-sec/index-1.2.6.html‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8" />
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="X-UA-Compatible" content="ie=edge" />
7+
<title>jQuery Security Acceptance Tests</title>
8+
<link rel="stylesheet" href="styles.css" />
9+
<script src="jquery-1.2.6.js"></script>
10+
<script src="main.js"></script>
11+
</head>
12+
<body>
13+
<div id="grid">
14+
<div id="button-container">
15+
<button type="button" onclick="CVE_2012_6708();">CVE-2012-6708</button>
16+
<button type="button" onclick="CVE_2015_9251();">CVE-2015-9251</button>
17+
<button type="button" onclick="CVE_2019_11358();">CVE-2019-11358</button>
18+
<button type="button" onclick="CVE_2020_7656();">CVE-2020-7656</button>
19+
<button type="button" onclick="CVE_2020_11022();">CVE-2020-11022</button>
20+
<button type="button" onclick="CVE_2020_11023();">CVE-2020-11023</button>
21+
</div>
22+
<div id="log">
23+
24+
</div>
25+
</div>
26+
<div id="yee"></div>
27+
</body>
28+
</html>

‎security/1.2.7-sec/index-1.2.7-sec.html‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8" />
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<meta http-equiv="X-UA-Compatible" content="ie=edge" />
7+
<title>jQuery Security Acceptance Tests</title>
8+
<link rel="stylesheet" href="styles.css" />
9+
<script src="jquery-1.2.7-sec.js"></script>
10+
<script src="main.js"></script>
11+
</head>
12+
<body>
13+
<div id="grid">
14+
<div id="button-container">
15+
<button type="button" onclick="CVE_2012_6708();">CVE-2012-6708</button>
16+
<button type="button" onclick="CVE_2015_9251();">CVE-2015-9251</button>
17+
<button type="button" onclick="CVE_2019_11358();">CVE-2019-11358</button>
18+
<button type="button" onclick="CVE_2020_7656();">CVE-2020-7656</button>
19+
<button type="button" onclick="CVE_2020_11022();">CVE-2020-11022</button>
20+
<button type="button" onclick="CVE_2020_11023();">CVE-2020-11023</button>
21+
</div>
22+
<div id="log">
23+
24+
</div>
25+
</div>
26+
<div id="yee"></div>
27+
</body>
28+
</html>

0 commit comments

Comments
 (0)