search

geonetwork / core-geonetwork

GeoNetwork is a catalog application to manage spatially referenced resources. It provides powerful metadata editing and search functions as well as an interactive web map viewer. It is currently used in numerous Spatial Data Infrastructure initiatives across the world.
http://geonetwork-opensource.org/
GNU General Public License v2.0
412 stars 487 forks source link

jQuery 2.4.2 scan XSS vulnerabilities: Request update jQuery 3.5.0 #4772

Open JDCampbell301 opened 4 years ago

JDCampbell301 commented 4 years ago

Describe the bug https://snyk.io/vuln/SNYK-JS-JQUERY-565129 or search for jQuery vulnerability

To Reproduce Accunetix security scan report indicates jQuery 2.4.2 has moderate risk vulnerability

Expected behavior It appears that the new 3.5.0 has fixed a more recent cross site scripting vulnerability, so it appears that we may need to jump all the way to the current version.

Additional context We are also working on resolving this since it is on our critical path. I have posted this issue since it probably exceeds the limits of our understand of the UI code.

https://github.com/geonetwork/core-geonetwork/pull/2520 was the update to jQuery 2.4,2 @PascalLike said :"The upgrade to the latest version 3.3.1 is not safe (and does not work)" Is that a backwards compatibility issue with jQuery 3 in general or specific to 3.3.1?

I will also repeat his request to "let me know is there is any extra precaution to take in these kind of updates."

JDCampbell301 commented 4 years ago

We have passed the security scan using jQuery 3.5.0. The root cause is a difference in the way nested self-closing html elements are interpreted. This jQuery change was necessary to fix the security vulnerability. jQeury 3.5.0 is the first (currently only) version without the vulnerability.

We modified GeoNetwork html to change eliminate the self-closing html. We tested by using the GeoNetwork UI and did not discover any failures. We will make a pull request with our changes.

Warning: We cannot be certain that every piece of nested self-closing html has been corrected. For example, we have not enabled INSPIRE, so that portion has not been tested.

jodygarnett commented 7 months ago

@JDCampbell301 this report does not follow the project's SECURITY policy and should not really be in the issue tracker. I wonder if this is why you have received a lack of response?

Can you take a moment to read SECURITY.md and share what you have learned? I do not wish to report on your behalf because I am sure there is interest in your pull request?

You did not mentioned your pull-request so I am going to go looking for it now. Perhaps it is already merged and you just forgot to close the issues.

jodygarnett commented 7 months ago

@JDCampbell301 searching pull requests I do not see anything under your name; perhaps another member of your team did this?

I am updating this ticket to have an explicit clear title (other wise issues stay open a long time). The latest version of jQuery at the time of writing is 3.7.1.