[wp-trac] [WordPress Trac] #50242: update jQuery version string in file to confirm not stock 1.12.4?
WordPress Trac
noreply at wordpress.org
Mon May 25 07:25:19 UTC 2020
#50242: update jQuery version string in file to confirm not stock 1.12.4?
--------------------------------+-----------------------------
Reporter: OptimizingMatters | Owner: (none)
Type: defect (bug) | Status: new
Priority: normal | Milestone: Awaiting Review
Component: External Libraries | Version:
Severity: normal | Keywords:
Focuses: |
--------------------------------+-----------------------------
This is a follow-up to #47020.
The security test at https://snyk.io (which is now included in the
webpagetest.org tests) detects jQuery as vulnerable in spite of the
security fixes having been backported and results in a big red F for
security on the webpagetest.org test page.
jQuery is now requested as "wp-includes/js/jquery/jquery.js?ver=1.12.4-wp"
but the file itself does not have that "-wp" string appended in the
version string, making it harder for tools not see this is not stock
jQuery 1.12.4:
/*! jQuery v1.12.4 | (c) jQuery Foundation | jquery.org/license |
WordPress 2019-05-16 */
updating this into
/*! jQuery v1.12.4-wp | (c) jQuery Foundation | jquery.org/license |
WordPress 2019-05-16 */
could make it easier for tools such as Snyk to distinguish between patched
and vulnerable version?
--
Ticket URL: <https://core.trac.wordpress.org/ticket/50242>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform
More information about the wp-trac
mailing list