Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Security: outdated bundled JavaScript (jQuery 1.7.1, WYMeditor 1.1.1 with underscore 1.4.4 and lodash 2.4.2)

未关闭
  • 哪里不对？
#437 4 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
javascript, jquery
领域
frontend, security, web-dev

调研方向

Start with the listed bundles: system/assets/jquery-1.7.1.min.js and system/wymeditor/jquery.wymeditor.min.js; check their loading points at index.php:76 and system/core/editor.php:29. The issue describes replacing jQuery and WYMeditor as a project requiring browser testing, with jQuery Migrate suggested for finding compatibility problems. Done means selecting and testing maintained replacements and documenting the bundled versions or keeping untrusted HTML away from jQuery DOM methods in the meantime.

由索引模型根据 Issue 内容生成。

描述

Impact: High Level: Difficult Type: Enhancement Value: Security

Summary

Severity: Low. Hypha ships and loads JavaScript libraries that are ten or more years old and have publicly known vulnerabilities. Whether they are exploitable depends on how Hypha calls them, and no concrete exploitable path in Hypha was found during the review. The risk is that these libraries remove protections that newer versions have (HTML handling, prototype pollution, template compilation), so any future XSS-adjacent bug in Hypha or its plugins is easier to turn into script execution. It is also a maintenance and audit problem: every security scanner flags them.

Affected code (dev 5dae13a), versions read from the files themselves. The bundled Bowser browser-detection library, originally listed here as well, is tracked separately in #453.

File Library Version Loaded
system/assets/jquery-1.7.1.min.js jQuery 1.7.1 (header) on every page, index.php:76
system/wymeditor/jquery.wymeditor.min.js (and .js) WYMeditor 1.1.1 (VERSION : "1.1.1", .js:364) in the editor, system/core/editor.php:29
same bundle Underscore.js 1.4.4 (.js:7970, :8036) in the editor
same bundle Lo-Dash 2.4.2 (.js:9201, :15910) in the editor
same bundle Rangy 1.2.2 (.js:22186) in the editor

The same files are on master.

Impact

Known issues of these versions, as published by the projects and in public advisories:

  • jQuery < 3.5 (CVE-2020-11022, CVE-2020-11023): passing untrusted HTML to DOM manipulation methods can execute script even after sanitising. jQuery < 1.9 (CVE-2012-6708): $(string) treats strings that contain < anywhere as HTML. jQuery < 3.4 (CVE-2019-11358): prototype pollution through $.extend(true, ...). jQuery < 3.0 (CVE-2015-9251): cross-domain AJAX responses can be executed as script.
  • Underscore < 1.12.1 (CVE-2021-23358) and lodash < 4.17.21 (CVE-2021-23337): code injection through template() options; lodash < 4.17.x also has several prototype-pollution issues (CVE-2018-3721, CVE-2018-16487, CVE-2019-10744, CVE-2020-8203).
  • WYMeditor 1.1.1 is old, the project is no longer actively maintained, and it was built for jQuery 1.x.

Suggested fix

No patch: replacing these libraries changes behaviour and needs testing in browsers.

  1. jQuery (see also #96): upgrade to 3.7.x. Hypha's own use is limited (system/assets/help.js, hypha-preview-image-file-field.js and inline scripts in editor.php, events.php, pages.php, users.php, mailinglist.php), but WYMeditor 1.1.1 was built for jQuery 1.x and is not known to work with jQuery 3, so in practice this goes together with step 2. As an intermediate step, jQuery Migrate can help find incompatible calls.
  2. WYMeditor: replace it with a maintained editor that produces clean HTML. This is a project of its own; it also removes the bundled underscore, lodash and Rangy.
  3. Until then: keep untrusted HTML out of jQuery DOM methods in Hypha's own JavaScript, and document the bundled versions in one place (for example system/README or the documentation) so they are visible to scanners and maintainers.

Patch

None.

Testing

Versions were read from the bundled files (headers and VERSION constants) in dev 5dae13a and master. The CVE list is based on the public advisories of the libraries; no proof-of-concept against Hypha was attempted.

Note: the fixes suggested here are a suggestion and a starting point, not a finished fix. Please review them and adapt them as you see fit.

Combined test. The security patches of this series (all but three, which conflict with each other and say so) were also applied together on dev (5dae13a) plus the fixes of #405 and #406, and run in a php:8.2-apache container against a copy of a ~1,330-page data set: anonymous request of every page (1,333 requests) and a logged-in request of every page and its edit view; no failures and no new PHP warnings. php -l was clean on 8.2 and 8.5.

Internal reference: SEC-025

主要语言
JavaScript
星标
5
派生
9
平均合并
18 小时 7 分钟
30 天内合并 PR
11

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

PlanBCode/hypha 的其他 Issue

查看 PlanBCode/hypha 的全部 Issue

相似的 Issue

更多 JavaScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。