Security issue in jQuery dependency

[vaibhavarora14]

🐛 Bug Report

Security issue for web is mentioned in - https://nvd.nist.gov/vuln/detail/CVE-2020-11022

To Reproduce

Security report points to path -
selenium-webdriver/lib/test/data/jquery-1.3.2.js

Expected behavior

Should selenium-webdriver still using jquery version below 3.5? I believe it should upgrade internal dependencies

[AutomatedTester]

This is a test only dependency. if you would like to submit a PR with the change that would be great

[harsha509]

Strange, am unable to see such file in [JS] dir. and also npm audit doesn't show the above vulnerability.

I've got one file and it is in path https://github.com/SeleniumHQ/selenium/blob/master/common/src/web/jquery-1.3.2.js

Am i missing anything here?

[vaibhavarora14]

@harsha509 You are maybe on correct path, I also found only that

[vaibhavarora14]

@AutomatedTester will try submitting PR

[barancev]

Well, the label was correct, sorry.

There are two issues:

1. why do we use an old version of jQuery in our tests? the answer is "who cares, it's good enough for the tests"
2. why and how JS binding exposes it to the end users? this should be fixed

[barancev]

I've just installed selenium-webdriver NPM package version 4.0.0-alpha.7 and can't find any mention of jquery there. So the issue seems to be fixed already.