vulnerable version of jQuery in use

longxinH / xhprof

PHP7/PHP8 support

http://pecl.php.net/package/xhprof

Apache License 2.0

1.04k stars 165 forks source link

vulnerable version of jQuery in use #64

Closed HonkXL closed 1 year ago

HonkXL commented 2 years ago

xhprof uses a outdated and vulnerable version of jQuery. Version 1.2.6. is rather old and we made a seurity scan of our servers and have seen that this jQuery version was used by Moodle that we have in use. I made a ticket there (MDL-73167). That was closed because the old jQuery is part of xhprof.

Think it would be a good idea to updated jQuery in xhprof.

longxinH commented 2 years ago

I am not very familiar with jQuery, if you can, please submit an upgraded PR

HonkXL commented 2 years ago

In xhprof/xhprof_html/jquery/ there is jQuery in a version 1.2.6. Versions 1.x and 2.x are outdated and won't get security and other updates. I think it will not work just to change the files to the newer ones, but I am not an expert in jQuery. Sorry.