Skip to content

Commit 6a7b621

Browse files
ctcpipctcpip
committed
✨ jQuery v1.12.5-sec
1 parent f161ba4 commit 6a7b621

File tree

4 files changed

+72
-24
lines changed

4 files changed

+72
-24
lines changed

‎README.md‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,17 @@ This repository contains unofficial end-of-life jQuery releases with vulnerabili
66

77
In a perfect world, at least every MAJOR EOL jQuery release line would have a security-patched release. "Major" refers to the meaning of the term in [SemVer](https://semver.org/), thus releases that have breaking changes. The goal is to provide a patched version of jQuery for all major release lines to provide a path of least resistance for all downstream users to upgrade to a secure version jQuery with [no (or minimal) breaking changes](#but-what-about-breaking-changes).
88

9-
| Status | jQuery version | jQuery-sec version | Branch | PR | Release | CVEs Patched |
10-
| ------ | -------------- | ------------------ | ----------- | -------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
11-
| ✅ | `1.2.6` | `1.2.7-sec` | [1.2.7-sec] | [PR][1.2.7-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| <del>CVE-2015-9251</del>\* \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
12-
| ✅ | `1.3.2` | `1.3.3-sec` | [1.3.3-sec] | [PR][1.3.3-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| <del>CVE-2015-9251</del>\* \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
13-
| ✅ | `1.4.4` | `1.4.5-sec` | [1.4.5-sec] | [PR][1.4.5-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
14-
| ✅ | `1.5.2` | `1.5.3-sec` | [1.5.3-sec] | [PR][1.5.3-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
15-
| ✅ | `1.6.4` | `1.6.5-sec` | [1.6.5-sec] | [PR][1.6.5-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
16-
| ✅ | `1.7.2` | `1.7.3-sec` | [1.7.3-sec] | [PR][1.7.3-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
17-
| ✅ | `1.8.3` | `1.8.4-sec` | [1.8.4-sec] | [PR][1.8.4-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
18-
| 🚧 | `1.12.4` | `1.12.5-sec` | | | | [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-11022] \| [CVE-2020-11023] |
19-
| 🚧 | `2.2.4` | `2.2.5-sec` | | | | [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-11022] \| [CVE-2020-11023] \| [CVE-2020-23064] |
9+
| Status | jQuery version | jQuery-sec version | Branch | PR | Release | CVEs Patched |
10+
| ------ | -------------- | ------------------ | ------------ | --------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
11+
| ✅ | `1.2.6` | `1.2.7-sec` | [1.2.7-sec] | [PR][1.2.7-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| <del>CVE-2015-9251</del>\* \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
12+
| ✅ | `1.3.2` | `1.3.3-sec` | [1.3.3-sec] | [PR][1.3.3-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| <del>CVE-2015-9251</del>\* \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
13+
| ✅ | `1.4.4` | `1.4.5-sec` | [1.4.5-sec] | [PR][1.4.5-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
14+
| ✅ | `1.5.2` | `1.5.3-sec` | [1.5.3-sec] | [PR][1.5.3-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
15+
| ✅ | `1.6.4` | `1.6.5-sec` | [1.6.5-sec] | [PR][1.6.5-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
16+
| ✅ | `1.7.2` | `1.7.3-sec` | [1.7.3-sec] | [PR][1.7.3-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
17+
| ✅ | `1.8.3` | `1.8.4-sec` | [1.8.4-sec] | [PR][1.8.4-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
18+
| ✅ | `1.12.4` | `1.12.5-sec` | [1.12.5-sec] | [PR][1.12.5-pr] | | [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-11022] \| [CVE-2020-11023] |
19+
| 🚧 | `2.2.4` | `2.2.5-sec` | | | | [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-11022] \| [CVE-2020-11023] \| [CVE-2020-23064] |
2020

2121
> [!IMPORTANT]
2222
> \*CVE-2015-9251 is not reproducible in `1.2.6` and `1.3.2`
@@ -72,6 +72,8 @@ Ultimately, our hope is that these patched versions can be approved and accepted
7272
[1.7.3-pr]: https://github.com/ctcpip/jquery-security-patches/pull/7
7373
[1.8.4-sec]: https://github.com/ctcpip/jquery-security-patches/tree/1.8.4-sec
7474
[1.8.4-pr]: https://github.com/ctcpip/jquery-security-patches/pull/8
75+
[1.12.5-sec]: https://github.com/ctcpip/jquery-security-patches/tree/1.12.5-sec
76+
[1.12.5-pr]: https://github.com/ctcpip/jquery-security-patches/pull/9
7577
[CVE-2011-4969]: https://github.com/advisories/GHSA-579v-mp3v-rrw5
7678
[CVE-2012-6708]: https://github.com/advisories/GHSA-2pqj-h3vj-pqgw
7779
[CVE-2015-9251]: https://github.com/advisories/GHSA-rmxg-73gg-4p98

‎security/README.md‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
- [Make](https://en.wikipedia.org/wiki/Make_(software))
1111
- Node.js
1212
- Node v20, the current LTS version at the time of this writing is the version used, although you may be successful with other versions
13-
- For older jQuery versions (1.2.6 through 1.5.2<!-- update as needed -->), you'll need to install php 5.6
13+
- For older jQuery versions (1.2.6 through 1.12.4<!-- update as needed -->), you'll need to install php 5.6
1414
- For Macs, We recommend using [homebrew-php](https://github.com/shivammathur/homebrew-php)
1515

1616
## Testing
@@ -111,6 +111,34 @@
111111
- `php -S 127.0.0.1:8000 -t test`
112112
- Open `127.0.0.1:8000/tests/index.html` in your browser
113113

114+
#### 1.12.4 / 1.12.5-sec
115+
116+
For prior versions, we were able to get away with the built-in php dev server.
117+
We were not so successful with 1.12.4, so you'll need to have (or install) a proper server.
118+
The path of least resistance is to use `nginx`.
119+
You should already have installed PHP -- if not, see [prerequisites](#prerequisites).
120+
121+
- Checkout the `1.12.4` or `1.12.5-sec` branch
122+
- From the root folder of the repo:
123+
- `brew install nginx`
124+
- `npm i -g grunt-cli`
125+
- Add the following `overrides` object to `package.json`:
126+
-`"overrides": { "graceful-fs": "^4.2.11" }`
127+
- Run `grunt`
128+
- If you get an error about `os.tmpDir()` in `node_modules/npm/node_modules/osenv/osenv.js` then:
129+
- Modify that file to call `os.tmpdir()` instead of `os.tmpDir()`
130+
- `grunt` should work now
131+
- A pre-configured `nginx` configuration file (`nginx.conf`) is in the root of the repo
132+
- Modify the first two paths near the top of the file to suit your filesystem
133+
- In a separate terminal window, run `nginx`, replacing the paths to suit your filesystem:
134+
- `/path/to/nginx/bin/nginx -c /path/to/jquery/repo/nginx.conf -g daemon\ off\;`
135+
- `cd test`
136+
- `brew services start php@5.6`
137+
- Open `127.0.0.1/tests/index.html` in your browser
138+
- When you are finished:
139+
- `CTRL+C` in the terminal where you are running `nginx`
140+
- `brew services stop php@5.6`
141+
114142
### A/B end-to-end acceptance tests
115143

116144
Tests run on every push in CI via [GitHub workflow](https://github.com/ctcpip/jquery-security-patches/actions/workflows/security-test.yml)
@@ -192,3 +220,16 @@ You can run the A/B tests locally in CI mode or manually in the browser
192220
- Modify both files to `require('fs')` and change `path.existsSync()` to `fs.existsSync()`
193221
- Run `grunt`
194222
- This will output `./dist/jquery.js`
223+
224+
#### 1.12.4 / 1.12.5-sec
225+
226+
- Checkout the `1.12.4` or `1.12.5-sec` branch
227+
- From the root folder of the repo:
228+
- `npm i -g grunt-cli`
229+
- Add the following `overrides` object to `package.json`:
230+
-`"overrides": { "graceful-fs": "^4.2.11" }`
231+
- Run `grunt`
232+
- If you get an error about `os.tmpDir()` in `node_modules/npm/node_modules/osenv/osenv.js` then:
233+
- Modify that file to call `os.tmpdir()` instead of `os.tmpDir()`
234+
- `grunt` should work now
235+
- This will output `./dist/jquery.js`

‎security/site/vendor/jquery-1.12.5-sec.js‎

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*!
2-
* jQuery JavaScript Library v1.12.4
2+
* jQuery JavaScript Library v1.12.5-sec
33
* http://jquery.com/
44
*
55
* Includes Sizzle.js
@@ -9,7 +9,7 @@
99
* Released under the MIT license
1010
* http://jquery.org/license
1111
*
12-
* Date: 2016-05-20T17:17Z
12+
* Date: 2024-02-18T08:52Z
1313
*/
1414

1515
(function( global, factory ) {
@@ -209,8 +209,9 @@ jQuery.extend = jQuery.fn.extend = function() {
209209
src = target[ name ];
210210
copy = options[ name ];
211211

212+
// Prevent Object.prototype pollution
212213
// Prevent never-ending loop
213-
if ( target === copy ) {
214+
if ( name === "__proto__" || target === copy ) {
214215
continue;
215216
}
216217

@@ -2859,9 +2860,10 @@ jQuery.fn.extend( {
28592860
var rootjQuery,
28602861

28612862
// A simple way to check for HTML strings
2862-
// Prioritize #id over <tag> to avoid XSS via location.hash (#9521)
2863-
// Strict HTML recognition (#11290: must start with <)
2864-
rquickExpr = /^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]*))$/,
2863+
// Prioritize #id over <tag> to avoid XSS via location.hash (trac-9521)
2864+
// Strict HTML recognition (trac-11290: must start with <)
2865+
// Shortcut simple #id case for speed
2866+
rquickExpr = /^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/,
28652867

28662868
init = jQuery.fn.init = function( selector, context, root ) {
28672869
var match, elem;
@@ -4522,7 +4524,6 @@ function createSafeFragment( document ) {
45224524

45234525
// We have to close these tags to support XHTML (#13200)
45244526
var wrapMap = {
4525-
option: [ 1, "<select multiple='multiple'>", "</select>" ],
45264527
legend: [ 1, "<fieldset>", "</fieldset>" ],
45274528
area: [ 1, "<map>", "</map>" ],
45284529

@@ -4538,9 +4539,6 @@ var wrapMap = {
45384539
_default: support.htmlSerialize ? [ 0, "", "" ] : [ 1, "X<div>", "</div>" ]
45394540
};
45404541

4541-
// Support: IE8-IE9
4542-
wrapMap.optgroup = wrapMap.option;
4543-
45444542
wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead;
45454543
wrapMap.th = wrapMap.td;
45464544

@@ -5871,7 +5869,6 @@ jQuery.fn.extend( {
58715869

58725870
var rinlinejQuery = / jQuery\d+="(?:null|\d+)"/g,
58735871
rnoshimcache = new RegExp( "<(?:" + nodeNames + ")[\\s/>]", "i" ),
5874-
rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:-]+)[^>]*)\/>/gi,
58755872

58765873
// Support: IE 10-11, Edge 10240+
58775874
// In IE/Edge using regex groups here causes severe slowdowns.
@@ -6127,7 +6124,7 @@ function remove( elem, selector, keepData ) {
61276124

61286125
jQuery.extend( {
61296126
htmlPrefilter: function( html ) {
6130-
return html.replace( rxhtmlTag, "<$1></$2>" );
6127+
return html;
61316128
},
61326129

61336130
clone: function( elem, dataAndEvents, deepDataAndEvents ) {
@@ -10358,6 +10355,13 @@ function createActiveXHR() {
1035810355

1035910356

1036010357

10358+
// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
10359+
jQuery.ajaxPrefilter( function( s ) {
10360+
if ( s.crossDomain ) {
10361+
s.contents.script = false;
10362+
}
10363+
} );
10364+
1036110365
// Install script dataType
1036210366
jQuery.ajaxSetup( {
1036310367
accepts: {

‎security/test/test.mjs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ const patchedVersions = [
1414
'1.6.5-sec',
1515
'1.7.3-sec',
1616
'1.8.4-sec',
17+
'1.12.5-sec',
1718
];
1819

1920
function banner(txt, {borderColor = 'magenta', textColor = 'cyan'} = {borderColor: 'magenta', textColor: 'cyan'}) {

0 commit comments

Comments
 (0)