4

I am working on an enterprise project and we have a upcoming new release. The security team runs a security scan, in that vulnerability report there is one point that I am struggling with. The project uses jQuery 1.4.x and it causes a XSS vulnerability, namely this one. I need to upgrade jQuery but the latest version will cause a lot of problems. My question is there least version of jQuery that is striped from the XSS vulnerability?

Improve this question
2
  • 3
    I recently wrote a blog post about this. I think your best option is to disable the execution of JavaScript responses using $.ajaxSetup({contents: {script: false}}).
    – Sjoerd
    Commented Jan 2, 2018 at 14:49
  • You can also sanitize the input and/or patch the vulnerable JQuery yourself
    – user63458
    Commented Apr 26, 2018 at 17:01

1 Answer 1

Reset to default
7

To get away from the reported issues, (which will show up via projects like retire JS), you'll need to use a JQuery version in the 3.x line. At least one of the commonly referenced issues (this one) required breaking changes and as such was never fixed in the 1.X stream.

The current latest version is 3.2.1 and I'm not aware of it having any disclosed XSS issues.

Improve this answer
3
  • Can the JQuery version 2.x line be suffice for this situation because I need to avoid from major update?
    – Deniz Gökçe
    Commented Jan 2, 2018 at 13:14
  • 2
    I'm afraid reading down that issue the last comment from the developers appears to be "Yes, this was a breaking change so we couldn't include it in 2.x now that we follow semver. Also, we no longer maintain jQuery 1.x/2.x, only the latest version, currently 3.x." so it sounds like you'd need 3.x
    – Rory McCune
    Commented Jan 2, 2018 at 13:21
  • 1
    Thank you! It seems like it has to be updated to the current version to make it work.
    – Deniz Gökçe
    Commented Jan 2, 2018 at 13:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .