Skip to content

Feature/jquery 3 5 0 compatibility#77

Merged
tagliala merged 4 commits intomasterfrom
feature/jquery-3_5_0-compatibility
Apr 11, 2020
Merged

Feature/jquery 3 5 0 compatibility#77
tagliala merged 4 commits intomasterfrom
feature/jquery-3_5_0-compatibility

Conversation

@tagliala
Copy link
Copy Markdown
Contributor

@tagliala tagliala commented Apr 11, 2020

Quoting from https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Security Fix

The main change in this release is a security fix, and it’s possible you will need to change your own code to adapt. Here’s why: jQuery used a regex in its jQuery.htmlPrefilter method to ensure that all closing tags were XHTML-compliant when passed to methods. For example, this prefilter ensured that a call like jQuery("<div class='hot' />") is actually converted to jQuery("<div class='hot'></div>"). Recently, an issue was reported that demonstrated the regex could introduce a cross-site scripting (XSS) vulnerability.

The HTML parser in jQuery <=3.4.1 usually did the right thing, but there were edge cases where parsing would have unintended consequences. The jQuery team agreed it was necessary to fix this in a minor release, even though some code relies on the previous behavior and may break. The jQuery.htmlPrefilter function does not use a regex in 3.5.0 and passes the string through unchanged.

This PR:

  • Tests against jQuery 3.5.0
  • Fixes JS tests
  • Fixes Ruby tests
  • Changes the default input_tag and label_tag to XHTML-compliant tags

@coveralls
Copy link
Copy Markdown

Coverage Status

Coverage remained the same at 100.0% when pulling 563c3f0 on feature/jquery-3_5_0-compatibility into bae630b on master.

@tagliala tagliala merged commit 8a671d8 into master Apr 11, 2020
@tagliala tagliala deleted the feature/jquery-3_5_0-compatibility branch April 11, 2020 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants