Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/jquery 3 5 0 compatibility #779

Merged
merged 4 commits into from
Apr 11, 2020

Conversation

tagliala
Copy link
Contributor

@tagliala tagliala commented Apr 11, 2020

Quoting from https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Security Fix

The main change in this release is a security fix, and it’s possible you will need to change your own code to adapt. Here’s why: jQuery used a regex in its jQuery.htmlPrefilter method to ensure that all closing tags were XHTML-compliant when passed to methods. For example, this prefilter ensured that a call like jQuery("<div class='hot' />") is actually converted to jQuery("<div class='hot'></div>"). Recently, an issue was reported that demonstrated the regex could introduce a cross-site scripting (XSS) vulnerability.

The HTML parser in jQuery <=3.4.1 usually did the right thing, but there were edge cases where parsing would have unintended consequences. The jQuery team agreed it was necessary to fix this in a minor release, even though some code relies on the previous behavior and may break. The jQuery.htmlPrefilter function does not use a regex in 3.5.0 and passes the string through unchanged.

This PR:

  • Tests against jQuery 3.5.0
  • Fixes JS tests
  • Fixes Ruby tests
  • Changes the default input_tag and label_tag to XHTML-compliant tags

@coveralls
Copy link

coveralls commented Apr 11, 2020

Coverage Status

Coverage remained the same at 100.0% when pulling 8a3600e on feature/jquery-3_5_0-compatibility into ef3126c on master.

@tagliala tagliala merged commit 17f3be4 into master Apr 11, 2020
@tagliala tagliala deleted the feature/jquery-3_5_0-compatibility branch April 11, 2020 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants