Skip to content

Commit 7da0eeb

Browse files
ctcpipctcpip
committed
✨ jQuery v2.2.5-sec
1 parent 3f354e8 commit 7da0eeb

File tree

4 files changed

+93
-55
lines changed

4 files changed

+93
-55
lines changed

‎README.md‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,19 +8,22 @@ In a perfect world, at least every MAJOR EOL jQuery release line would have a se
88

99
| Status | jQuery version | jQuery-sec version | Branch | PR | Release | CVEs Patched |
1010
| ------ | -------------- | ------------------ | ------------ | --------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
11-
| ✅ | `1.2.6` | `1.2.7-sec` | [1.2.7-sec] | [PR][1.2.7-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| <del>CVE-2015-9251</del>\* \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
12-
| ✅ | `1.3.2` | `1.3.3-sec` | [1.3.3-sec] | [PR][1.3.3-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| <del>CVE-2015-9251</del>\* \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
13-
| ✅ | `1.4.4` | `1.4.5-sec` | [1.4.5-sec] | [PR][1.4.5-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
14-
| ✅ | `1.5.2` | `1.5.3-sec` | [1.5.3-sec] | [PR][1.5.3-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
15-
| ✅ | `1.6.4` | `1.6.5-sec` | [1.6.5-sec] | [PR][1.6.5-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
16-
| ✅ | `1.7.2` | `1.7.3-sec` | [1.7.3-sec] | [PR][1.7.3-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
17-
| ✅ | `1.8.3` | `1.8.4-sec` | [1.8.4-sec] | [PR][1.8.4-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
11+
| ✅ | `2.2.4` | `2.2.5-sec` | [2.2.5-sec] | [PR][2.2.5-pr] | | [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-11022] \| [CVE-2020-11023] \| [CVE-2020-23064] |
1812
| ✅ | `1.12.4` | `1.12.5-sec` | [1.12.5-sec] | [PR][1.12.5-pr] | | [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-11022] \| [CVE-2020-11023] |
19-
| 🚧 | `2.2.4` | `2.2.5-sec` | | | | [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-11022] \| [CVE-2020-11023] \| [CVE-2020-23064] |
13+
| ✅ | `1.8.3` | `1.8.4-sec` | [1.8.4-sec] | [PR][1.8.4-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
14+
| ✅ | `1.7.2` | `1.7.3-sec` | [1.7.3-sec] | [PR][1.7.3-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
15+
| ✅ | `1.6.4` | `1.6.5-sec` | [1.6.5-sec] | [PR][1.6.5-pr] | | [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
16+
| ✅ | `1.5.2` | `1.5.3-sec` | [1.5.3-sec] | [PR][1.5.3-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
17+
| ✅ | `1.4.4` | `1.4.5-sec` | [1.4.5-sec] | [PR][1.4.5-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| [CVE-2015-9251] \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
18+
| ✅ | `1.3.2` | `1.3.3-sec` | [1.3.3-sec] | [PR][1.3.3-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| <del>CVE-2015-9251</del>\* \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
19+
| ✅ | `1.2.6` | `1.2.7-sec` | [1.2.7-sec] | [PR][1.2.7-pr] | | [CVE-2011-4969] \| [CVE-2012-6708] \| <del>CVE-2015-9251</del>\* \| [CVE-2019-11358] \| [CVE-2020-7656] \| [CVE-2020-11022] \| [CVE-2020-11023] |
2020

2121
> [!IMPORTANT]
2222
> \*CVE-2015-9251 is not reproducible in `1.2.6` and `1.3.2`
2323
24+
> [!IMPORTANT]
25+
> CVE-2020-23064 is reproducible in all versions, but our understanding is that it is a duplicate of CVE-2020-11023
26+
2427
> [!NOTE]
2528
> The 3.x release line is currently supported by jQuery, so we have no need to provide patched versions of 3.x at this time. jQuery 3.5 introduced a breaking change, but it was necessary to fix CVE-2020-11022 and CVE-2020-11023. However, since these vulnerabilities are present in virtually all versions of jQuery, there would be no value in providing a patched version of 3.4 as it would need to include that breaking change anyway.
2629
@@ -74,6 +77,8 @@ Ultimately, our hope is that these patched versions can be approved and accepted
7477
[1.8.4-pr]: https://github.com/ctcpip/jquery-security-patches/pull/8
7578
[1.12.5-sec]: https://github.com/ctcpip/jquery-security-patches/tree/1.12.5-sec
7679
[1.12.5-pr]: https://github.com/ctcpip/jquery-security-patches/pull/9
80+
[2.2.5-sec]: https://github.com/ctcpip/jquery-security-patches/tree/2.2.5-sec
81+
[2.2.5-pr]: https://github.com/ctcpip/jquery-security-patches/pull/10
7782
[CVE-2011-4969]: https://github.com/advisories/GHSA-579v-mp3v-rrw5
7883
[CVE-2012-6708]: https://github.com/advisories/GHSA-2pqj-h3vj-pqgw
7984
[CVE-2015-9251]: https://github.com/advisories/GHSA-rmxg-73gg-4p98

‎security/README.md‎

Lines changed: 29 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,11 @@
1010
- [Make](https://en.wikipedia.org/wiki/Make_(software))
1111
- Node.js
1212
- Node v20, the current LTS version at the time of this writing is the version used, although you may be successful with other versions
13-
- For older jQuery versions (1.2.6 through 1.12.4<!-- update as needed -->), you'll need to install php 5.6
13+
- You'll need to install php 5.6 -- a newer version of php will probably work as well, but we used 5.6
1414
- For Macs, We recommend using [homebrew-php](https://github.com/shivammathur/homebrew-php)
15+
- For versions up to and including 1.8.3 / 1.8.4-sec, we were able to get away with the built-in php dev server. For later versions, you'll need to have (or install) a proper server.
16+
- The path of least resistance is to use `nginx`:
17+
- `brew install nginx`
1518

1619
## Testing
1720

@@ -113,14 +116,8 @@
113116

114117
#### 1.12.4 / 1.12.5-sec
115118

116-
For prior versions, we were able to get away with the built-in php dev server.
117-
We were not so successful with 1.12.4, so you'll need to have (or install) a proper server.
118-
The path of least resistance is to use `nginx`.
119-
You should already have installed PHP -- if not, see [prerequisites](#prerequisites).
120-
121119
- Checkout the `1.12.4` or `1.12.5-sec` branch
122120
- From the root folder of the repo:
123-
- `brew install nginx`
124121
- `npm i -g grunt-cli`
125122
- Add the following `overrides` object to `package.json`:
126123
-`"overrides": { "graceful-fs": "^4.2.11" }`
@@ -139,6 +136,23 @@ You should already have installed PHP -- if not, see [prerequisites](#prerequisi
139136
- `CTRL+C` in the terminal where you are running `nginx`
140137
- `brew services stop php@5.6`
141138

139+
#### 2.2.4 / 2.2.5-sec
140+
141+
- Checkout the `2.2.4` or `2.2.5-sec` branch
142+
- From the root folder of the repo:
143+
- `npm i -g grunt-cli`
144+
- Run `grunt`
145+
- A pre-configured `nginx` configuration file (`nginx.conf`) is in the root of the repo
146+
- Modify the first two paths near the top of the file to suit your filesystem
147+
- In a separate terminal window, run `nginx`, replacing the paths to suit your filesystem:
148+
- `/path/to/nginx/bin/nginx -c /path/to/jquery/repo/nginx.conf -g daemon\ off\;`
149+
- `cd test`
150+
- `brew services start php@5.6`
151+
- Open `127.0.0.1/tests/index.html` in your browser
152+
- When you are finished:
153+
- `CTRL+C` in the terminal where you are running `nginx`
154+
- `brew services stop php@5.6`
155+
142156
### A/B end-to-end acceptance tests
143157

144158
Tests run on every push in CI via [GitHub workflow](https://github.com/ctcpip/jquery-security-patches/actions/workflows/security-test.yml)
@@ -233,3 +247,11 @@ You can run the A/B tests locally in CI mode or manually in the browser
233247
- Modify that file to call `os.tmpdir()` instead of `os.tmpDir()`
234248
- `grunt` should work now
235249
- This will output `./dist/jquery.js`
250+
251+
#### 2.2.4 / 2.2.5-sec
252+
253+
- Checkout the `2.2.4` or `2.2.5-sec` branch
254+
- From the root folder of the repo:
255+
- `npm i -g grunt-cli`
256+
- Run `grunt`
257+
- This will output `./dist/jquery.js`

‎security/site/vendor/jquery-2.2.5-sec.js‎

Lines changed: 50 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*!
2-
* jQuery JavaScript Library v2.2.4
2+
* jQuery JavaScript Library v2.2.5-sec
33
* http://jquery.com/
44
*
55
* Includes Sizzle.js
@@ -9,7 +9,7 @@
99
* Released under the MIT license
1010
* http://jquery.org/license
1111
*
12-
* Date: 2016-05-20T17:23Z
12+
* Date: 2024-02-21T04:25Z
1313
*/
1414

1515
(function( global, factory ) {
@@ -209,8 +209,9 @@ jQuery.extend = jQuery.fn.extend = function() {
209209
src = target[ name ];
210210
copy = options[ name ];
211211

212+
// Prevent Object.prototype pollution
212213
// Prevent never-ending loop
213-
if ( target === copy ) {
214+
if ( name === "__proto__" || target === copy ) {
214215
continue;
215216
}
216217

@@ -4249,12 +4250,41 @@ var rscriptType = ( /^$|\/(?:java|ecma)script/i );
42494250

42504251

42514252

4253+
( function() {
4254+
var fragment = document.createDocumentFragment(),
4255+
div = fragment.appendChild( document.createElement( "div" ) ),
4256+
input = document.createElement( "input" );
4257+
4258+
// Support: Android 4.0-4.3, Safari<=5.1
4259+
// Check state lost if the name is set (#11217)
4260+
// Support: Windows Web Apps (WWA)
4261+
// `name` and `type` must use .setAttribute for WWA (#14901)
4262+
input.setAttribute( "type", "radio" );
4263+
input.setAttribute( "checked", "checked" );
4264+
input.setAttribute( "name", "t" );
4265+
4266+
div.appendChild( input );
4267+
4268+
// Support: Safari<=5.1, Android<4.2
4269+
// Older WebKit doesn't clone checked state correctly in fragments
4270+
support.checkClone = div.cloneNode( true ).cloneNode( true ).lastChild.checked;
4271+
4272+
// Support: IE<=11+
4273+
// Make sure textarea (and checkbox) defaultValue is properly cloned
4274+
div.innerHTML = "<textarea>x</textarea>";
4275+
support.noCloneChecked = !!div.cloneNode( true ).lastChild.defaultValue;
4276+
4277+
// Support: IE <=9 only
4278+
// IE <=9 replaces <option> tags with their contents when inserted outside of
4279+
// the select element.
4280+
div.innerHTML = "<option></option>";
4281+
support.option = !!div.lastChild;
4282+
} )();
4283+
4284+
42524285
// We have to close these tags to support XHTML (#13200)
42534286
var wrapMap = {
42544287

4255-
// Support: IE9
4256-
option: [ 1, "<select multiple='multiple'>", "</select>" ],
4257-
42584288
// XHTML parsers do not magically insert elements in the
42594289
// same way that tag soup parsers do. So we cannot shorten
42604290
// this by omitting <tbody> or other required elements.
@@ -4266,12 +4296,14 @@ var wrapMap = {
42664296
_default: [ 0, "", "" ]
42674297
};
42684298

4269-
// Support: IE9
4270-
wrapMap.optgroup = wrapMap.option;
4271-
42724299
wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead;
42734300
wrapMap.th = wrapMap.td;
42744301

4302+
// Support: IE <=9 only
4303+
if ( !support.option ) {
4304+
wrapMap.optgroup = wrapMap.option = [ 1, "<select multiple='multiple'>", "</select>" ];
4305+
}
4306+
42754307

42764308
function getAll( context, tag ) {
42774309

@@ -4396,32 +4428,6 @@ function buildFragment( elems, context, scripts, selection, ignored ) {
43964428
}
43974429

43984430

4399-
( function() {
4400-
var fragment = document.createDocumentFragment(),
4401-
div = fragment.appendChild( document.createElement( "div" ) ),
4402-
input = document.createElement( "input" );
4403-
4404-
// Support: Android 4.0-4.3, Safari<=5.1
4405-
// Check state lost if the name is set (#11217)
4406-
// Support: Windows Web Apps (WWA)
4407-
// `name` and `type` must use .setAttribute for WWA (#14901)
4408-
input.setAttribute( "type", "radio" );
4409-
input.setAttribute( "checked", "checked" );
4410-
input.setAttribute( "name", "t" );
4411-
4412-
div.appendChild( input );
4413-
4414-
// Support: Safari<=5.1, Android<4.2
4415-
// Older WebKit doesn't clone checked state correctly in fragments
4416-
support.checkClone = div.cloneNode( true ).cloneNode( true ).lastChild.checked;
4417-
4418-
// Support: IE<=11+
4419-
// Make sure textarea (and checkbox) defaultValue is properly cloned
4420-
div.innerHTML = "<textarea>x</textarea>";
4421-
support.noCloneChecked = !!div.cloneNode( true ).lastChild.defaultValue;
4422-
} )();
4423-
4424-
44254431
var
44264432
rkeyEvent = /^key/,
44274433
rmouseEvent = /^(?:mouse|pointer|contextmenu|drag|drop)|click/,
@@ -5121,13 +5127,10 @@ jQuery.fn.extend( {
51215127
} );
51225128

51235129

5124-
var
5125-
rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:-]+)[^>]*)\/>/gi,
5126-
51275130
// Support: IE 10-11, Edge 10240+
51285131
// In IE/Edge using regex groups here causes severe slowdowns.
51295132
// See https://connect.microsoft.com/IE/feedback/details/1736512/
5130-
rnoInnerhtml = /<script|<style|<link/i,
5133+
var rnoInnerhtml = /<script|<style|<link/i,
51315134

51325135
// checked="checked" or checked
51335136
rchecked = /checked\s*(?:[^=]|=\s*.checked.)/i,
@@ -5322,7 +5325,7 @@ function remove( elem, selector, keepData ) {
53225325

53235326
jQuery.extend( {
53245327
htmlPrefilter: function( html ) {
5325-
return html.replace( rxhtmlTag, "<$1></$2>" );
5328+
return html;
53265329
},
53275330

53285331
clone: function( elem, dataAndEvents, deepDataAndEvents ) {
@@ -9194,6 +9197,13 @@ jQuery.ajaxTransport( function( options ) {
91949197

91959198

91969199

9200+
// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
9201+
jQuery.ajaxPrefilter( function( s ) {
9202+
if ( s.crossDomain ) {
9203+
s.contents.script = false;
9204+
}
9205+
} );
9206+
91979207
// Install script dataType
91989208
jQuery.ajaxSetup( {
91999209
accepts: {

‎security/test/test.mjs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ const patchedVersions = [
1515
'1.7.3-sec',
1616
'1.8.4-sec',
1717
'1.12.5-sec',
18+
'2.2.5-sec',
1819
];
1920

2021
function banner(txt, {borderColor = 'magenta', textColor = 'cyan'} = {borderColor: 'magenta', textColor: 'cyan'}) {

0 commit comments

Comments
 (0)