Drupal 11 ships with jQuery 4: https://www.drupal.org/node/3445202.

This means that jQuery 3 functions that were deprecated have been fully removed and are no longer available. The ParseJSON function in particular affects this module: https://api.jquery.com/jQuery.parseJSON/.

This means that this code will fail on Drupal 11.

We simply have to replace all usages of it with the native JSON.parse() function: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global.... The native JSON parser is supported accross all browsers for a very long, and is very stable. So this is not a breaking change that we only need to do for Drupal 11. It can go into the current module version without any breaking changes.

CommentFileSizeAuthor
#6 autologout-d11-compatibility-3557332-88.patch1.71 KBgueguerreiro

Issue fork autologout-3557332

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

naveenraj i created an issue. See original summary.

naveenraj i changed the visibility of the branch 3557332- to hidden.

naveenraj i’s picture

naveenraj i commented
Status: Active » Needs review

Category: Bug report
Title: Fix: Secure JSON parsing (SCA issue) in autologout.js

Proposed resolution
File: js/autologout.js
Issue:
The $.parseJSON() method was used for JSON parsing, which is deprecated and flagged as insecure in Static Code Analysis (SCA).

Resolution:
Replaced $.parseJSON() with a safer and standard JSON.parse() wrapped in a try...catch block to prevent runtime errors.

Branch: 3557332-bug-report-sca
Commit: 9fa186dd

gueguerreiro opened merge request !88

gueguerreiro made their first commit to this issue’s fork.

gueguerreiro’s picture

gueguerreiro
Primary language Portuguese, Portugal
Location Lisboa
commented
Title: Bug report (SCA Scan) » jQuery.parseJSON is removed on jQuery 4 and fails on Drupal11
Assigned: naveenraj i » Unassigned
Issue summary: View changes
StatusFileSize
new autologout-d11-compatibility-3557332-88.patch1.71 KB

Updating this issue since I believe the original title and description don't highlight the severity of the issue for newer sites. I updated the current MR slightly to fix trailing white spaces and some identation issues, but I'm still leaving it as Needs Review because I'm not sure about the inclusion of the "try/catch" approach with a silent error. We might probably want an error somewhere if that portion of the code fails for any reason? Otherwise it might be impossible to detect issues.

Attaching a patch with the fix, if it's useful for anyone.

the_g_bomb made their first commit to this issue’s fork.

the_g_bomb’s picture

the_g_bomb commented
Status: Needs review » Needs work

This will need a rebase and the MR should be updated to target the 2.x branch

deaom’s picture

deaom commented

This is also already solved in the 2.x branch and can be closed.
2.x. branch does 

if (typeof response === 'string') {
            response = JSON.parse(response);
          }

and the MR does:

    if (typeof response === 'string') {
            try {
              response = JSON.parse(response);
            } catch (e) {
            return;
            }
          }

Leaving status as is so maintainers can close it out as they wish.

the_g_bomb’s picture

the_g_bomb commented
Status: Needs work » Fixed

As per the previous comment, the other work done has solved this. Please feel free to reopen and update the steps to reproduce if you are still having problems.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.