[Git][security-tracker-team/security-tracker][master] Add investigation notes for jquery.

[Chris Lamb]

Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
867a1ab3 by Chris Lamb at 2020-06-06T21:43:53+01:00
Add investigation notes for jquery.

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=====================================
data/dla-needed.txt
=====================================
@@ -60,6 +60,15 @@ graphicsmagick (Roberto C. Sánchez)
 imagemagick (Markus Koschany)
 --
 jquery
+  NOTE: 20200606: This was fixed upstream in a set of wider changes
+  NOTE: 20200606: (a938d7b128) which cannot be applied. Even the specific part
+  NOTE: 20200606: cannot be cherry picked as it calls out to jQuery.parseHTML
+  NOTE: 20200606: which has a keepScripts argument. We could easily change the
+  NOTE: 20200606: the rscript regex to also match the problematic whitespace, but
+  NOTE: 20200606: this may not be complete as it does not do all the other checks
+  NOTE: 20200606: and magic that parseHTML does (eg. hacking document.implementation)
+  NOTE: 20200606: I do not know enough about this sanitisation and we don't want
+  NOTE: 20200606: to be playing whack-a-mole here. (lamby)
 --
 libdatetime-timezone-perl
   NOTE: 20200514: LTS update must wait on oldstable update first to prevent newer version in LTS (roberto)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/867a1ab374688479bd486e1e3101b21881675c8f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/867a1ab374688479bd486e1e3101b21881675c8f
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200606/41f28b7e/attachment-0001.html>