Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Security: outdated bundled JavaScript (jQuery 1.7.1, WYMeditor 1.1.1 with underscore 1.4.4 and lodash 2.4.2)

Aperta
  • Qualcosa non va?
#437 4 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
javascript, jquery
Ambito
frontend, security, web-dev

Direzione di ricerca

Start with the listed bundles: system/assets/jquery-1.7.1.min.js and system/wymeditor/jquery.wymeditor.min.js; check their loading points at index.php:76 and system/core/editor.php:29. The issue describes replacing jQuery and WYMeditor as a project requiring browser testing, with jQuery Migrate suggested for finding compatibility problems. Done means selecting and testing maintained replacements and documenting the bundled versions or keeping untrusted HTML away from jQuery DOM methods in the meantime.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Impact: High Level: Difficult Type: Enhancement Value: Security

Summary

Severity: Low. Hypha ships and loads JavaScript libraries that are ten or more years old and have publicly known vulnerabilities. Whether they are exploitable depends on how Hypha calls them, and no concrete exploitable path in Hypha was found during the review. The risk is that these libraries remove protections that newer versions have (HTML handling, prototype pollution, template compilation), so any future XSS-adjacent bug in Hypha or its plugins is easier to turn into script execution. It is also a maintenance and audit problem: every security scanner flags them.

Affected code (dev 5dae13a), versions read from the files themselves. The bundled Bowser browser-detection library, originally listed here as well, is tracked separately in #453.

File Library Version Loaded
system/assets/jquery-1.7.1.min.js jQuery 1.7.1 (header) on every page, index.php:76
system/wymeditor/jquery.wymeditor.min.js (and .js) WYMeditor 1.1.1 (VERSION : "1.1.1", .js:364) in the editor, system/core/editor.php:29
same bundle Underscore.js 1.4.4 (.js:7970, :8036) in the editor
same bundle Lo-Dash 2.4.2 (.js:9201, :15910) in the editor
same bundle Rangy 1.2.2 (.js:22186) in the editor

The same files are on master.

Impact

Known issues of these versions, as published by the projects and in public advisories:

  • jQuery < 3.5 (CVE-2020-11022, CVE-2020-11023): passing untrusted HTML to DOM manipulation methods can execute script even after sanitising. jQuery < 1.9 (CVE-2012-6708): $(string) treats strings that contain < anywhere as HTML. jQuery < 3.4 (CVE-2019-11358): prototype pollution through $.extend(true, ...). jQuery < 3.0 (CVE-2015-9251): cross-domain AJAX responses can be executed as script.
  • Underscore < 1.12.1 (CVE-2021-23358) and lodash < 4.17.21 (CVE-2021-23337): code injection through template() options; lodash < 4.17.x also has several prototype-pollution issues (CVE-2018-3721, CVE-2018-16487, CVE-2019-10744, CVE-2020-8203).
  • WYMeditor 1.1.1 is old, the project is no longer actively maintained, and it was built for jQuery 1.x.

Suggested fix

No patch: replacing these libraries changes behaviour and needs testing in browsers.

  1. jQuery (see also #96): upgrade to 3.7.x. Hypha's own use is limited (system/assets/help.js, hypha-preview-image-file-field.js and inline scripts in editor.php, events.php, pages.php, users.php, mailinglist.php), but WYMeditor 1.1.1 was built for jQuery 1.x and is not known to work with jQuery 3, so in practice this goes together with step 2. As an intermediate step, jQuery Migrate can help find incompatible calls.
  2. WYMeditor: replace it with a maintained editor that produces clean HTML. This is a project of its own; it also removes the bundled underscore, lodash and Rangy.
  3. Until then: keep untrusted HTML out of jQuery DOM methods in Hypha's own JavaScript, and document the bundled versions in one place (for example system/README or the documentation) so they are visible to scanners and maintainers.

Patch

None.

Testing

Versions were read from the bundled files (headers and VERSION constants) in dev 5dae13a and master. The CVE list is based on the public advisories of the libraries; no proof-of-concept against Hypha was attempted.

Note: the fixes suggested here are a suggestion and a starting point, not a finished fix. Please review them and adapt them as you see fit.

Combined test. The security patches of this series (all but three, which conflict with each other and say so) were also applied together on dev (5dae13a) plus the fixes of #405 and #406, and run in a php:8.2-apache container against a copy of a ~1,330-page data set: anonymous request of every page (1,333 requests) and a logged-in request of every page and its edit view; no failures and no new PHP warnings. php -l was clean on 8.2 and 8.5.

Internal reference: SEC-025

Lingua principale
JavaScript
Stelle
5
Fork
9
Merge medio
18h 7m
PR unite (30g)
11

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di PlanBCode/hypha

Tutte le issue di PlanBCode/hypha

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.