Patch local versions of jquery? (Minor vulnerability fix) [#3049071]

Hello,

I think jquery versions should be patched following this release: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/

Patches seem quite straightforward to apply: https://github.com/DanielRuf/snyk-js-jquery-174006

Comment	File	Size	Author
#6	Screen Shot 2019-07-29 at 11.39.51 PM.png	174.71 KB	coffeedevgirl
#6	Screen Shot 2019-07-29 at 11.39.59 PM.png	189.94 KB	coffeedevgirl
#3	image.png	42.75 KB	Nixou

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

18 April 2019 at 09:03

dolu created an issue. See original summary.

Comment #2

Ludo.R

Brussels

CreditAttribution: Ludo.R commented 18 April 2019 at 10:40

I guess if you're using Drupal core 7.66+, it's not needed.

Comment #3

Nixou CreditAttribution: Nixou at Actency commented 18 April 2019 at 11:30

File	Size
image.png	42.75 KB

I think the patch is needed even if you are on 7.66 because the jquery file used will not be the one of the core (which is fixed).

All jquery files included in this module are not patched so they will remain vulnerable.

Comment #4

Ludo.R

Brussels

CreditAttribution: Ludo.R commented 18 April 2019 at 13:26

@Nixou,

That's what I thought initially, but using Drupal 7.66 will fix the vulnerability.
There's a new file that will override jquery's extend() function.

See: https://git.drupalcode.org/project/drupal/commit/39e2971

* This provides the Object.prototype pollution vulnerability fix to Drupal
* installations running older jQuery versions, including the versions shipped
* with Drupal core and https://www.drupal.org/project/jquery_update.

The patch is still needed for people that are not upgrading to 7.66

Comment #5

solideogloria CreditAttribution: solideogloria commented 13 June 2019 at 18:40

That was literally the only fix in 7.66, so even if they don't upgrade to 7.66, they can cherry-pick the fix into their codebase.

Comment #6

coffeedevgirl CreditAttribution: coffeedevgirl commented 30 July 2019 at 21:58

File	Size
Screen Shot 2019-07-29 at 11.39.59 PM.png	189.94 KB
Screen Shot 2019-07-29 at 11.39.51 PM.png	174.71 KB

Hello, I have an issue related to jQuery 3.4.0, I did the update to Drupal core 7.67 and now I have issues with all the js files with issues like :
Uncaught TypeError: $ is not a function
Uncaught TypeError: $form.once is not a function
My question is basically if I need to apply this patch even if I did the update to 7.67? I tried different changes in the code without success until now, and specifically, I have so many issues with the module Views Conditional 7.x-1.3 at the moment to try to open the pop up's. Any help?