RetireJS / retire.js

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
https://retirejs.github.io/retire.js/
Other
3.66k stars 414 forks source link

Prolbem with jquery func extractor #330

Closed fxa closed 4 years ago

fxa commented 4 years ago

Retire.js version: 6.14.5

node version: 10.21.0

Type: Bug

Description: in the repo json the func extractor jquery.extractors.func[0] is incorrect. Current value: "(jQuery || $ || $jq || $j).fn.jquery". It is clear, what is intended: if one of the 4 exists, use .fn.jquery. But that does not work! Lets say, jQuery is not defined, but $. Then the browser will throw a ReferenceError, because jQuery is not defined.

Steps to reproduce

Expected behaviour: -> result: (currend jQuery version, for now "3.4.1" (btw, that should be retired by github.io ;-) ))

That could be related with https://github.com/RetireJS/retire.js/issues/314.

Btw I think all funcs should be written, that no exception should be thrown I dislike exception driven development and think, it is a bad pattern

fxa commented 4 years ago

I think, correct would be "(typeof jQuery !== 'undefined'? jQuery : typeof $ !== 'undefined' && $.fn ? $ : {fn: {jquery: null}}).fn.jquery" remarks:

eoftedal commented 4 years ago

Thanks for the report.