-
-
Notifications
You must be signed in to change notification settings - Fork 7.9k
Open CVE on vendored jquery #11199
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
Would it make sense to not vendor jquery in the repo, but
Right now jquery weights 1.3Mb; compare this with the baseline test images that weight ~50Kb each and that we are painstakingly trying to avoid adding to the repo. |
That might run afoul with the Debian packaging rules. But, certainly, there
has to be a better solution than vendoring a js library...
…On Tue, May 8, 2018 at 8:36 PM, Antony Lee ***@***.***> wrote:
Would it make sense to not vendor jquery in the repo, but
1. change setup.py so that it fetches jquery at build time, normally
online but configurably (via e.g. environment variable) from a local path
(to satisfy distro packager constraints).
2. the sdist would not contain jquery but follow the same idea
3. the wheels would contain jquery.
Right now jquery weights 1.3Mb; compare this with the baseline test images
that weight ~50Kb each and that we are painstakingly trying to avoid adding
to the repo.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#11199 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AARy-HdbRhMgZWsaSKyfGvuV8MZ9iBSqks5twjn7gaJpZM4T2uCC>
.
|
Hence the "configurably (via e.g. environment variable) from a local path (to satisfy distro packager constraints)." |
Ah, I missed that. I wonder what jupyter is doing?
…On Tue, May 8, 2018 at 8:51 PM, Antony Lee ***@***.***> wrote:
Hence the "configurably (via e.g. environment variable) from a local path
(to satisfy distro packager constraints)."
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#11199 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AARy-HRlj-oTuvdg4iM_htPNFuMcwUjUks5twj2PgaJpZM4T2uCC>
.
|
Installing the notebook from a source checkout requires bower/npm/whateverjs: https://jupyter-notebook.readthedocs.io/en/latest/contributing.html https://github.com/jupyter/notebook/blob/master/setupbase.py#L565 Actually now that I think of it, for debian & friends the even simpler solution is to also bundle jquery in the sdists (they're building from a sdist, not from a checkout). See comment in linked jupyter setupbase:
|
Do we actually need the non-minimal version of jquery? It doesn't seem to be referenced anywhere else. |
@tacaswell told me it's the debian packaging rules... |
In Fedora, all sources should be in its preferred form (i.e., editable by someone without going through hoops). That means non-minified sources. Ideally, the minified form should be generated from that source as well during package builds, but that's not always the case. |
(I don't think #11246 is actually that hard to push to completion if anyone wants to take a stab at it...) |
This is addressed (via #13445 ). |
Bug report
Bug summary
Your vendored jquery is old and has a known security vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2016-7103
Code for reproduction
Look at https://github.com/matplotlib/matplotlib/blob/master/lib/matplotlib/backends/web_backend/jquery/js/jquery-1.11.3.js
Humble request
Please update your vendored jquery.
The text was updated successfully, but these errors were encountered: