search

documentcloud / underscore-contrib

The brass buckles on Underscore's utility belt
MIT License
621 stars 117 forks source link

security remark by retire.js #218

Closed KaiSchwarz-cnic closed 4 years ago

KaiSchwarz-cnic commented 7 years ago

fyi

node_modules/underscore-contrib/test/vendor/jquery.js ↳ jquery 1.7.2 has known vulnerabilities: severity: medium; bug: 11290, summary: Selector interpreted as HTML; http://bugs.jquery.com/ticket/11290 http://research.insecurelabs.org/jquery/test/ severity: medium; issue: 2432, summary: 3rd party CORS request may execute; https://github.com/jquery/jquery/issues/2432 http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/

jgonggrijp commented 4 years ago

We should check whether we can use jQuery-from-NPM for the unittests instead of shipping a copy with the source code.