Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

upgrade jquery and grunt to more recent versions #21

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

gyulalaszlo
Copy link
Contributor

Fix Dependabot issues with JQuery and Grunt -- none of the mentioned specific problems are relevant for this specific code, but the versions used in the repo are generally very-very old, and should be updated if possible:

JQuery:

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Grunt:

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

I've done some minimal testing and can confirm that it builds and the basic pages load without problems (looking at the JQuery major changelog for 3.0 I dont think there are any breaking changes, but my assumptions are not good replacements for real-world tests.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant