Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Security: outdated bundled JavaScript (jQuery 1.7.1, WYMeditor 1.1.1 with underscore 1.4.4 and lodash 2.4.2)

オープン
  • 何か問題がありますか？
#437 コメント 4 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
35/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
javascript, jquery
領域
frontend, security, web-dev

調査の方向性

Start with the listed bundles: system/assets/jquery-1.7.1.min.js and system/wymeditor/jquery.wymeditor.min.js; check their loading points at index.php:76 and system/core/editor.php:29. The issue describes replacing jQuery and WYMeditor as a project requiring browser testing, with jQuery Migrate suggested for finding compatibility problems. Done means selecting and testing maintained replacements and documenting the bundled versions or keeping untrusted HTML away from jQuery DOM methods in the meantime.

索引モデルが issue の本文から書いたものです。

説明

Impact: High Level: Difficult Type: Enhancement Value: Security

Summary

Severity: Low. Hypha ships and loads JavaScript libraries that are ten or more years old and have publicly known vulnerabilities. Whether they are exploitable depends on how Hypha calls them, and no concrete exploitable path in Hypha was found during the review. The risk is that these libraries remove protections that newer versions have (HTML handling, prototype pollution, template compilation), so any future XSS-adjacent bug in Hypha or its plugins is easier to turn into script execution. It is also a maintenance and audit problem: every security scanner flags them.

Affected code (dev 5dae13a), versions read from the files themselves. The bundled Bowser browser-detection library, originally listed here as well, is tracked separately in #453.

File Library Version Loaded
system/assets/jquery-1.7.1.min.js jQuery 1.7.1 (header) on every page, index.php:76
system/wymeditor/jquery.wymeditor.min.js (and .js) WYMeditor 1.1.1 (VERSION : "1.1.1", .js:364) in the editor, system/core/editor.php:29
same bundle Underscore.js 1.4.4 (.js:7970, :8036) in the editor
same bundle Lo-Dash 2.4.2 (.js:9201, :15910) in the editor
same bundle Rangy 1.2.2 (.js:22186) in the editor

The same files are on master.

Impact

Known issues of these versions, as published by the projects and in public advisories:

  • jQuery < 3.5 (CVE-2020-11022, CVE-2020-11023): passing untrusted HTML to DOM manipulation methods can execute script even after sanitising. jQuery < 1.9 (CVE-2012-6708): $(string) treats strings that contain < anywhere as HTML. jQuery < 3.4 (CVE-2019-11358): prototype pollution through $.extend(true, ...). jQuery < 3.0 (CVE-2015-9251): cross-domain AJAX responses can be executed as script.
  • Underscore < 1.12.1 (CVE-2021-23358) and lodash < 4.17.21 (CVE-2021-23337): code injection through template() options; lodash < 4.17.x also has several prototype-pollution issues (CVE-2018-3721, CVE-2018-16487, CVE-2019-10744, CVE-2020-8203).
  • WYMeditor 1.1.1 is old, the project is no longer actively maintained, and it was built for jQuery 1.x.

Suggested fix

No patch: replacing these libraries changes behaviour and needs testing in browsers.

  1. jQuery (see also #96): upgrade to 3.7.x. Hypha's own use is limited (system/assets/help.js, hypha-preview-image-file-field.js and inline scripts in editor.php, events.php, pages.php, users.php, mailinglist.php), but WYMeditor 1.1.1 was built for jQuery 1.x and is not known to work with jQuery 3, so in practice this goes together with step 2. As an intermediate step, jQuery Migrate can help find incompatible calls.
  2. WYMeditor: replace it with a maintained editor that produces clean HTML. This is a project of its own; it also removes the bundled underscore, lodash and Rangy.
  3. Until then: keep untrusted HTML out of jQuery DOM methods in Hypha's own JavaScript, and document the bundled versions in one place (for example system/README or the documentation) so they are visible to scanners and maintainers.

Patch

None.

Testing

Versions were read from the bundled files (headers and VERSION constants) in dev 5dae13a and master. The CVE list is based on the public advisories of the libraries; no proof-of-concept against Hypha was attempted.

Note: the fixes suggested here are a suggestion and a starting point, not a finished fix. Please review them and adapt them as you see fit.

Combined test. The security patches of this series (all but three, which conflict with each other and say so) were also applied together on dev (5dae13a) plus the fixes of #405 and #406, and run in a php:8.2-apache container against a copy of a ~1,330-page data set: anonymous request of every page (1,333 requests) and a logged-in request of every page and its edit view; no failures and no new PHP warnings. php -l was clean on 8.2 and 8.5.

Internal reference: SEC-025

主要言語
JavaScript
スター
5
フォーク
9
平均マージ
18時間 7分
マージ済み PR（30日）
11

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

PlanBCode/hypha のほかの issue

PlanBCode/hypha の issue をすべて見る

似ている issue

JavaScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。