Bug/19702 bbq.js proto secure #4563
Conversation
Login is required but it is open for anyone to create an account. You just need to provide a username and email address. |
|
I checked the upstream project where this issue was also found, but never fixed fully. For the sake of any other projects using jquery-bbq, I suggest to share your solution upstream also. Links:
Other noteworthy info:
|
| @@ -465,7 +465,9 @@ | |||
| // (Object) An object representing the deserialized params string. | |||
|
|
|||
| $.deparam = jq_deparam = function( params, coerce ) { | |||
There was a problem hiding this comment.
Perhaps you can add a comment header block in the first lines of this file, stating the changes made compared to 1.4pre. Something along the lines of:
Additional changes to this file:
- Removed support for IE8 and below
- Fixed prototype pollution (CVE-2021-20086)
There was a problem hiding this comment.
I add a doc block near the top of the file:
/*
* Additional changes to this file:
* - Removed support for IE8 and below
* - Fixed prototype pollution (CVE-2021-20086)
* - Minified with `uglifyjs jquery.ba-bbq.js --compress -o jquery.ba-bbq.min.js`
*/
| @@ -1,18 +1,17 @@ | |||
| /* | |||
There was a problem hiding this comment.
Perhaps add an addition comment that says:
Manually re-uglified with `uglifyjs jquery.ba-bbq.js --compress -o jquery.ba-bbq.min.js`
There was a problem hiding this comment.
I don't think that such information should be in minified version. If we want to document how to minify it it the future, it should be rather in source file.
There was a problem hiding this comment.
I added this information in the a new doc block in the source file and also added that same doc block to the minified file.
|
@kevin-foster-uk could you look at the above? When this PR is done I can prepare a new yii release. |
Sorry for the delay I have been on vacation. Will update asap. |
This PR fixes a security issue reported to LimeSurvey (https://bugs.limesurvey.org/view.php?id=19702).
We have patched jquery-bbq.js to prevent injection of proto.