Skip to content

Open CVE on vendored jquery #11199

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
msarahan opened this issue May 8, 2018 · 10 comments
Closed

Open CVE on vendored jquery #11199

msarahan opened this issue May 8, 2018 · 10 comments
Labels
Release critical For bugs that make the library unusable (segfaults, incorrect plots, etc) and major regressions.
Milestone

Comments

@msarahan
Copy link
Contributor

msarahan commented May 8, 2018

Bug report

Bug summary

Your vendored jquery is old and has a known security vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2016-7103

Code for reproduction

Look at https://github.com/matplotlib/matplotlib/blob/master/lib/matplotlib/backends/web_backend/jquery/js/jquery-1.11.3.js

Humble request

Please update your vendored jquery.

@tacaswell tacaswell added this to the v2.2.3 milestone May 8, 2018
@anntzer
Copy link
Contributor

anntzer commented May 9, 2018

Would it make sense to not vendor jquery in the repo, but

  1. change setup.py so that it fetches jquery at build time, normally online but configurably (via e.g. environment variable) from a local path (to satisfy distro packager constraints).
  2. the sdist would not contain jquery but follow the same idea
  3. the wheels would contain jquery.

Right now jquery weights 1.3Mb; compare this with the baseline test images that weight ~50Kb each and that we are painstakingly trying to avoid adding to the repo.

@WeatherGod
Copy link
Member

WeatherGod commented May 9, 2018 via email

@anntzer
Copy link
Contributor

anntzer commented May 9, 2018

Hence the "configurably (via e.g. environment variable) from a local path (to satisfy distro packager constraints)."

@WeatherGod
Copy link
Member

WeatherGod commented May 9, 2018 via email

@anntzer
Copy link
Contributor

anntzer commented May 9, 2018

Installing the notebook from a source checkout requires bower/npm/whateverjs: https://jupyter-notebook.readthedocs.io/en/latest/contributing.html https://github.com/jupyter/notebook/blob/master/setupbase.py#L565
I'm basically advocating for the same model, but replacing all the relevant tooling by "download jquery".

Actually now that I think of it, for debian & friends the even simpler solution is to also bundle jquery in the sdists (they're building from a sdist, not from a checkout). See comment in linked jupyter setupbase:

                # If we're an sdist, we aren't a repo and everything should be present.
                # Don't rebuild js/css in that case.

@tacaswell tacaswell added the Release critical For bugs that make the library unusable (segfaults, incorrect plots, etc) and major regressions. label May 14, 2018
@dstansby
Copy link
Member

Do we actually need the non-minimal version of jquery? It doesn't seem to be referenced anywhere else.

@anntzer
Copy link
Contributor

anntzer commented Jul 26, 2018

@tacaswell told me it's the debian packaging rules...

@QuLogic
Copy link
Member

QuLogic commented Jul 26, 2018

In Fedora, all sources should be in its preferred form (i.e., editable by someone without going through hoops). That means non-minified sources. Ideally, the minified form should be generated from that source as well during package builds, but that's not always the case.

@anntzer
Copy link
Contributor

anntzer commented Jul 26, 2018

(I don't think #11246 is actually that hard to push to completion if anyone wants to take a stab at it...)

@tacaswell tacaswell modified the milestones: v2.2.3, v2.2.4 Aug 5, 2018
@tacaswell
Copy link
Member

This is addressed (via #13445 ).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Release critical For bugs that make the library unusable (segfaults, incorrect plots, etc) and major regressions.
Projects
None yet
Development

No branches or pull requests

6 participants