The included jquery version is vulnerable

[dvzrv]

The vendored version of jquery (1.9.1) is vulnerable to many security issues, which are tracked in CVEs:

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5312
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4969
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6662
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9251
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7103
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Please note, that maybe not all of the above are actually relevant for the included jquery version. I compiled the list from what seemed relevant, going through a list of CVEs, mentioning jquery: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery

However, this shows, that updating the vendored version would be a good idea! :)

[muxator]

That's right, @dvzrv.

Indeed, as of current develop (b3d8f85), the vendored jquery version is 1.9.1 from 2013-02-04.
jQuery 1.x branch is EOLed, as well (jquery/jquery.com#162).

As a stopgap measure, we can try to upgrade to the latest jQuery 1.x version, 1.12.4 from 2016-05-20.

Unfortunately, simply replacing src/static/js/jquery.js with the new version is not enough, since Etherpad whines with:

TypeError: window.$ is undefined in http://localhost:9001/javascripts/lib/ep_etherpad-lite/static/js/ace2_common.js?callback=require.define (line 11420)

I'll see if there is a proper fix.

[muxator]

I think I found the solution, taking inspiration from this Parcel issue:

$ hg diff src/static/js/rjquery.js
diff --git a/src/static/js/rjquery.js b/src/static/js/rjquery.js
--- a/src/static/js/rjquery.js
+++ b/src/static/js/rjquery.js
@@ -1,5 +1,5 @@
 
 // Proviedes a require'able version of jQuery without leaking $ and jQuery;
-require('./jquery');
+window.$ = require('./jquery');
 var jq = window.$.noConflict(true);
 exports.jQuery = exports.$ = jq;

[lpagliari]

Great job, @muxator!

[dvzrv]

@muxator thanks for looking into this so fast!